uCreator Android Spyware Steals Telegram Credentials and Clones WeChat Accounts

# uCreator Android Spyware Steals Telegram Credentials and Clones WeChat Accounts

https://gcdradar.vercel.app/incidents/ucreator-android-spyware-steals-telegram-credentials-and-clo · AIR-2026-1528 · closed 2026-11-09

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed active malware campaign targeting messaging apps.
- Fix status: No fix needed
- First reported: 2026-10-26
- AI role: No AI role
- Products: Telegram, WeChat, uCreator

## Summary

A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by embedding malicious code into modified application copies. The spyware targets users who install apps outside official stores or run them inside container apps.

## What to do

Avoid downloading applications from unofficial sources or third-party container apps.

## Affected and fixed versions

- Affected: Telegram Android apps
- Affected: WeChat Android apps

## Latest updates

- 2026-10-26: uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts (https://thehackernews.com/2026/10/ucreator-android-spyware-can-steal.html)

## Sources

- 2026-10-26 The Hacker News: uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts https://thehackernews.com/2026/10/ucreator-android-spyware-can-steal.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.