Ovi’s analysis, published October 21, 2026, describes uCreator as a rentable Android spyware kit whose makers call the product YingGai. Its reported code can capture a Telegram two-step verification password, while a separate route through the Onion Box container can support WeChat account cloning.
How the reported account mechanisms work
In a modified Telegram app, uCreator’s code reportedly hooks the login-proof process and copies the two-step verification password before it is hashed. Ovi’s analysis also describes code that can query Telegram’s local message store and manipulate sessions, including resetting sessions, changing the linked phone number, deleting the account, and hiding an attacker’s session from the device list shown in the modified app.
The reported WeChat route works differently: Onion Box runs the unmodified WeChat app inside a container. The kit can copy the app’s login identity and data, then use a bundled script to support account cloning.
Ovi identified code supporting about 20 apps. The detailed mechanisms described here concern Telegram and WeChat.
Installation routes and app identity
The reported routes include modified apps installed outside official stores, social engineering, and WeChat running inside Onion Box. Ovi could not determine how every victim was infected.
Some tampered Telegram X copies use the same package name as the legitimate Google Play app. A matching package name by itself therefore does not authenticate an app copy.
What the Android 17 test found
On a Pixel 10 Pro running Android 17, uCreator’s hooking engine could not find a required internal Android function. Frida, a separate hooking tool, could still hook apps in that test. Ovi described the result as extra work for the kit’s developers.
What the Baohuo comparison adds
The Telegram namespace com.ucreator.tgjar also appears in Doctor Web’s description of Android.Backdoor.Baohuo.1.origin. The Hacker News reported on October 26, 2026, that a technical comparison found matching command names and command-and-control (C2) infrastructure as well. Ovi described shared ownership as unproven.
Doctor Web’s technical entry describes Baohuo, specifically, as being inserted into Telegram X copies in three ways: by modifying the main DEX file, by dynamically injecting code with LSPatch, or by loading a separate DEX file from app resources. Doctor Web also describes Baohuo using a C2 server and Redis database for commands. Its reported heartbeat sent account and device details every three minutes, and it requested a task every minute. These are Baohuo details.
Doctor Web’s estimate of more than 58,000 infected devices applies to Baohuo. Ovi said server data could not measure uCreator’s victim impact.
On October 23, 2026, The Hacker News reported that a DNS check found uCreator’s version-upload domain resolving to 121.37.194[.]194.
