Published: · Region: Global · Category: cyber

uCreator Spyware in Fake Telegram Apps Lets Attackers Steal 2FA Codes and Clone WeChat Accounts

Researchers say a commercial Android spyware kit dubbed uCreator hides inside modified Telegram apps, extracts chats and two-factor authentication passwords, and can clone WeChat accounts.

A spyware-for-rent toolkit targeting Android devices is turning popular messaging apps into vehicles for surveillance and account theft, security researchers say.

The kit, known as uCreator, is designed to be embedded inside modified versions of mainstream Android applications, with a particular focus on Telegram clients. Once a user installs one of these trojanized apps, the malware can quietly harvest Telegram two-factor authentication (2FA) passwords and copy chat content, giving its operators access to private conversations.

Investigators report that uCreator also supports cloning of WeChat accounts, extending the threat to another of the world’s most widely used messaging platforms.

Unlike bespoke implants used in narrow intelligence operations, uCreator is built to scale by repackaging familiar apps. Users are invited to download slightly altered Telegram clients that present themselves as enhanced or unlocked, but in reality carry spyware code.

After installation, the malware can capture one-time 2FA codes handled through the compromised app. That undermines a security measure many users rely on to protect their accounts even if passwords are exposed.

For activists, journalists and business users who depend on Telegram or WeChat, this kind of compromise can expose contact networks, planning chats and sensitive documents. Ordinary users face risks ranging from fraud conducted via hijacked accounts to long-term monitoring of their communications.

uCreator occupies a middle ground between traditional remote access trojans and full-featured spyware suites sold to state clients. Its modular structure lets operators choose what data to collect and how to exfiltrate it, while its focus on widely used apps helps it blend malicious traffic into normal network flows.

The campaign appears alongside other identity-focused attacks, such as operations where intruders replay stolen Microsoft 365 sign-in tokens, register unauthorized devices in corporate identity systems and alter multi-factor authentication settings to preserve access. Together, these trends put pressure on multi-factor authentication as a reliable barrier.

Signals to follow include efforts by app stores and download sites to identify and remove known uCreator-laced packages, any changes Telegram and WeChat make to their account recovery and 2FA processes, and whether governments move to regulate or ban commercial spyware kits of this type. Reports from targeted communities, such as journalists or dissidents discovering overlapping compromises tied to modified messaging apps, will help map who is renting uCreator and for what purposes.

Sources

Related Coverage

GLOBAL

‘Gheist’ Campaign Hijacks GitHub Accounts to Drain Secrets From Build Logs

Researchers have uncovered an ongoing campaign dubbed ‘Gheist’ that used stolen tokens to compromise more than 850 GitHub accounts and plant over 13,500 malicious workflows, dumping private repository secrets into build logs that attackers later downloaded and erased from view.
GLOBAL

Planted Downloads File Led AI Coding Agent to Run Malware in Over 90% of Test Attempts

A real‑world attack used a single malicious file in a developer’s Downloads folder to steer an AI coding agent into installing malware, and controlled tests showed an AI model executed the code in more than 90% of trials.
GLOBAL

France’s Nuclear ‘Forward Deterrence’ and BRICS’ Growing Share of World Output Signal Shift in Global Power

France is working with ten European partners to extend its nuclear deterrent through a “forward deterrence” plan, while Russia’s parliament speaker says BRICS now accounts for nearly 40% of global GDP and $1.2 trillion in internal trade.
WARNING

Reports: Ukrainian Cruise Missiles Target Russia’s Tula Region, Possibly Moscow-Bound

Air-raid alerts late morning Monday report two Ukrainian cruise missiles heading toward Russia’s Tula region, with a possible trajectory toward the Moscow area. A successful deep strike into Russia’s core industrial belt would test Moscow’s air defenses, raise escalation pressure on the Kremlin and sharpen European security and energy risk calculations.
WARNING

Reports: Germany to Buy Ukraine’s 1,000‑km Bars Cruise Missile for Bundeswehr

Germany is preparing to buy and test Ukraine’s Bars cruise missile for its own forces, the Financial Times reported around 10:42–10:43 UTC. The move would mark the first adoption of a Ukrainian‑designed offensive strike system by a major NATO power, tightening Kyiv–Berlin defense ties and signaling a more assertive European posture on long‑range strike capability against Russia.