New Android Spyware for Rent Clones WeChat Accounts

A new rentable Android spyware kit can clone WeChat accounts and steal Telegram 2FA codes by hiding inside unofficial app versions.

A newly discovered Android spyware kit, dubbed uCreator, is being offered for rent to attackers seeking to hijack Telegram and WeChat accounts. According to research first reported by The Hacker News, the malware achieves this by hiding inside modified, but fully functional, versions of the popular messaging apps. The primary infection vector involves tricking users into installing these tampered applications from outside of official sources like the Google Play Store. This method, known as sideloading, is a common entry point for mobile malware. Once installed, the malicious code can execute its payload, which includes the ability to steal two-factor authentication (2FA) passwords from Telegram and completely clone a user's WeChat account, giving the attacker full access. The Telegram-specific component of the kit has been linked to a previously known backdoor called Baohuo, indicating that its creators are likely building upon or repurposing existing malicious codebases.

The technical mechanism behind uCreator is a classic repackaging attack. Instead of exploiting a vulnerability in the Android operating system itself, the attackers take the legitimate application package (APK) for Telegram or WeChat, decompile it, and inject their malicious code. They then recompile the package and distribute it through third-party websites, forums, or direct messages. When a user installs and runs this trojanized app, it functions as expected, masking the spyware's presence. The malicious code runs in the background with the same permissions as the legitimate app, allowing it to intercept user input, read messages, and access authentication tokens. For WeChat, the kit can also use a container app, which creates a virtualized environment to run the real WeChat app inside, giving the container full control to monitor and manipulate its activity. This approach effectively bypasses security measures that rely on the integrity of the app itself, as the malicious code is woven directly into its fabric.

This discovery highlights the continued growth of the Malware-as-a-Service (MaaS) model in the cybercrime ecosystem. By offering uCreator as a rentable kit, its developers have significantly lowered the barrier to entry for conducting sophisticated mobile surveillance and account takeovers. Less-skilled threat actors can now pay a fee to access powerful tools that were once the domain of well-resourced hacking groups or state-sponsored entities. This commercialization of cybercrime tools makes attacks more widespread and attribution more difficult. The MaaS trend mirrors developments in other areas, such as Ransomware-as-a-Service (RaaS), and signifies a mature, service-oriented criminal economy. The focus shifts from developing unique exploits to marketing and distributing effective, easy-to-use attack platforms, which ultimately increases the overall volume and velocity of threats targeting both individuals and organizations.

For CTOs, security teams, and developers, the emergence of spyware like uCreator serves as a critical reminder of the risks associated with uncontrolled software environments. The most effective defense is not a single tool but a layered security posture centered on user education and strict device management policies. Enforcing rules that prohibit employees from sideloading applications from untrusted sources is the single most important step to mitigate this specific threat. Mobile Device Management (MDM) solutions can be used to enforce these policies and maintain a baseline of security across all corporate-owned or managed devices. This incident also underscores that even strong security features like 2FA can be undermined if the underlying application or device is compromised. The focus for security professionals must be on securing the entire endpoint and its software supply chain, rather than relying solely on the security promises of individual applications.

The uCreator kit demonstrates the growing accessibility of sophisticated mobile surveillance tools via a malware-as-a-service model. For security and engineering teams, this lowers the bar for attackers to compromise key communication channels, bypassing even multi-factor authentication on platforms like Telegram and threatening corporate data security.

The rental model for spyware like uCreator puts advanced account takeover capabilities into more hands, increasing the risk of corporate espionage and data theft. Businesses that rely on platforms like WeChat and Telegram for communication face a heightened threat of compromised accounts, potentially leading to significant financial or reputational damage.