Telegram's two-step verification is designed to protect accounts from unauthorized access, but a commercial Android spyware kit can intercept the password used to secure them.
The spyware, called uCreator, hides malicious code inside modified versions of legitimate Android apps, including Telegram X. According to security researcher Ovi, it can capture Telegram's two-step verification password before the application hashes it, potentially allowing attackers to compromise accounts without breaching Telegram's servers.
The kit also supports capabilities targeting WeChat accounts and other mobile applications. Its commercial rental model could make these attacks accessible to operators who lack the resources to develop sophisticated spyware themselves.
How uCreator compromises messaging apps
The risk starts with apps that look legitimate but are distributed outside official app stores, where users install them by sideloading.
A similar campaign involving the Baohuo Android backdoor had infected more than 58,000 devices by October 2025, according to Doctor Web. Ovi later identified code and infrastructure linking Baohuo to uCreator, a commercial spyware kit, although the connection does not prove the same operators ran both campaigns.
What makes uCreator particularly concerning is that its tampered apps can still function normally and connect to the services' official servers. This is not entirely new: modified clients such as GBWhatsApp showed similar ability to connect users to WhatsApp servers.
For WeChat, the deployed malware can run the app inside a virtual container, extract account data, and support account cloning. The kit's code supports roughly 20 messaging apps and mobile wallets, underscoring the many ways renters can target victims.
The platform’s apparent targets include users in China and Southeast Asia, although its rental model could allow operators to deploy it elsewhere. The available findings do not establish the full geographic reach of any resulting infections.
How developers and users can reduce the risk
uCreator's commercial rental model raises concerns about how easily sophisticated mobile spyware could spread. Defending against these threats requires stronger application security controls and greater caution when installing software.
For developers, the ability of modified applications to communicate with legitimate services highlights the importance of application integrity checks. Developers can use integrity verification, server-side validation, and other controls to help identify unauthorized application modifications.
However, these protections are not foolproof, particularly when attackers control the environment in which an application runs.
Apps can implement integrity checks to detect unauthorized code modifications and use server-side verification to reject requests from clients that fail those checks. However, no single check guarantees that a client is safe.
For users, keeping Android updated remains an important security measure. Ovi's tests found that changes introduced in Android 17 made it harder for uCreator to run its exploit successfully.
The broader lesson is that account security depends on more than strong passwords and two-step verification. When attackers compromise the application or device handling those credentials, even legitimate security features can be undermined.
Other news: A data exposure involving AI platform 302.ai left 17.6 million files accessible through a misconfigured cloud storage bucket, including private AI conversations, personal information, and business documents.