uCreator Android Spyware Steals Telegram 2FA and Clones WeChat

A new Android spyware kit named uCreator has been found to capture two‑factor authentication (2FA) codes from Telegram and duplicate WeChat accounts by embedding malicious code in counterfeit versions of the two apps. Researchers discovered the threat after analyzing samples that were distributed outside official app stores and through a container app that runs WeChat inside the kit.

The spyware reaches victims only when they install a tampered copy of Telegram or WeChat, or when they use the kit’s own wrapper to launch WeChat. Once installed, the malicious module intercepts the 2FA password generated by Telegram, allowing the attacker to log into the victim’s account. For WeChat, the code extracts authentication data and creates a cloned account that mirrors the original user’s contacts and messages. The Telegram component appears to share code with a previously identified backdoor known as Baohuo.

The campaign targets Android users who download apps from unofficial sources, a practice that bypasses the security checks performed by Google Play. Because the spyware is hidden inside functional copies of popular messaging apps, users may not notice any abnormal behavior until their accounts are compromised. The threat is limited to those who actively install the fake apps, but the potential impact includes loss of private conversations, unauthorized transactions, and further phishing attacks using the hijacked accounts.

To protect against this type of malware, users should only download apps from reputable stores such as Google Play or the official Apple App Store. Verify the publisher’s name and check app reviews before installing. Enable app verification features that warn about modified APK files. Regularly review active sessions in Telegram and WeChat and revoke any that are unfamiliar. Using a strong, unique password for each service and enabling push‑based 2FA where possible adds another layer of defense. Free tools on ComputerScams.com, such as the password strength checker and the website checker, can help assess the security of your credentials and the legitimacy of URLs.

If you suspect your device is infected, run a reputable mobile antivirus scan and consider reinstalling the affected apps from official sources. Change your Telegram 2FA password and any linked email passwords immediately. Report suspicious apps to the platform’s abuse team and, if necessary, inform local cybercrime authorities.

A practical step you can take right now is to open the app store on your device, search for the official Telegram and WeChat apps, and reinstall them directly from the verified listings. This ensures any hidden spyware is removed.

Source: Read the original report