Actor Profile

Ovi is a security researcher who discovered and analyzed the uCreator Android spyware kit in October 2026. Ovi is not a threat actor but rather the researcher who exposed this rentable spyware operation. The actual threat actors behind uCreator remain unidentified; they operate a commercial spyware-as-a-service model, renting the kit to customers who can remotely control it against multiple messaging apps. The kit's makers provide a cloud console for merchants and resellers, indicating a profit-driven cybercrime operation. The Telegram component of uCreator matches Baohuo backdoor (reported by Doctor Web in October 2025), which infected over 58,000 devices. It remains unclear whether the kit's developers or their customers conducted the campaigns tracked by Doctor Web.

TTPs (Tactics, Techniques, Procedures)

Initial Access: Sideloading of trojanized applications via unofficial channels, in-app ads leading to fake app store sites, distribution through third-party stores (APKPure, ApkSum, AndroidP). Execution: Malicious code embedded within modified legitimate apps (Telegram X, WeChat) that executes with app permissions; app virtualization via custom container app "Onion Box" (洋葱盒子). Credential Access: Function hooking to intercept Telegram 2FA passwords before hashing, extraction of WeChat login credentials. Collection: Database queries against local message stores to exfiltrate chat history, copying account data including phone numbers and names. Command and Control: Local command server running inside each trojanized app, remote C2 server (com.ucreator.tgjar namespace), beaconing every three minutes. Defense Evasion: Hiding attacker sessions from device lists shown to victims, using legitimate app package names to avoid detection. Persistence: Session manipulation to lock out legitimate account owners while maintaining attacker access, account cloning for WeChat.

Targets & Patterns

The uCreator kit targets users of mobile messaging and wallet applications, with apparent geographic focus on China, Southeast Asia, Brazil, and Indonesia. Doctor Web's 2025 infection data showed India (22.8%), Brazil (20.5%), and Indonesia (9.6%) as top affected countries. Ovi's analysis of compromised command servers revealed victim data from China and the United States. The kit supports approximately 20 applications including Telegram, WeChat, WeCom, QQ, WhatsApp, LINE, Zalo, KakaoTalk, Viber, and mobile wallet apps GCash and MoMo. Distribution campaigns used Portuguese and Indonesian language banners, promoting Telegram X as a dating and video chat app to lure victims. The targeting pattern suggests focus on users of Asian messaging platforms and financial services, likely for account takeover, financial fraud, and espionage. Victims are primarily individuals who install apps from unofficial sources or fall for social engineering tactics directing them to fake app stores.

Historical Context

The Telegram component of uCreator directly corresponds to the Baohuo backdoor documented by Doctor Web in October 2025. Technical indicators confirm this link: identical code namespace (com.ucreator.tgjar), matching C2 infrastructure, and overlapping command structures. Doctor Web reported over 58,000 infected devices from Baohuo campaigns that began spreading in mid-2024. Ovi's October 2026 analysis did not reference Doctor Web's findings, and Doctor Web did not identify the commercial kit behind Baohuo. The newest uCreator sample recovered by Ovi dates to July 29, 2026, indicating continued development. This spyware follows a pattern established by earlier Android malware using app virtualization and code injection: FjordPhantom (2023) and GodFather banking trojan (2025) both ran legitimate apps with embedded attacker code. However, uCreator distinguishes itself as a rentable product with modular architecture, allowing customers to target any app for which the developers create a module.

Defensive Recommendations

  • Block sideloading of applications from unofficial sources through mobile device management (MDM) policies; educate users on risks of installing apps outside Google Play Store
  • Verify application digital signatures and package names before installation; legitimate Telegram X copies will have official developer signatures even if package names match
  • Monitor for suspicious local server activity on mobile devices; uCreator runs command servers inside trojanized apps that may generate unusual localhost traffic
  • Implement runtime application self-protection (RASP) or detect function hooking frameworks; uCreator's hooking engine intercepts app functions to steal credentials before encryption
  • Review active Telegram sessions across all devices regularly; hidden attacker sessions may not appear in compromised apps but should be visible on clean clients, enabling detection of account compromise