Ovi tadqiqotchisi topgan uCreator nomli ijaraga beriladigan Android josuslik dasturi Telegram va WeChat hisoblarini egallab oladi — u o'z kodini ikkita ilovaning ishlaydigan nusxalariga yashiradi. U faqat rasmiy ilova do'konlaridan tashqarida tarqatiladigan bu buzilgan nusxalardan birini o'rnatgan odamlarga yoki WeChat-ni to'plam ishlab chiqaruvchilarning o'z konteyner ilovasi ichida ishlatganlarga ta'sir qiladi.
To'plamning Telegram qismi Baohuo nomli orqa eshik bilan mos keladi, bu haqda Doctor Web 2025-yil oktyabrda xabar bergan. Doctor Web Baohuo-ni Telegram X, Telegram'dan Android ilovasi, buzilgan nusxalarida topgan. O'sha paytda kompaniya 58 000 dan ortiq qurilma zararlanganini taxmin qilgan.
The Hacker News ikkita hisobotni solishtirdi. Doctor Web'ning Baohuo haqidagi texnik tavsifi Ovi tahlili bilan bir xil kod nom maydoni com.ucreator.tgjar, bir xil buyruq va boshqaruv (C2) serveri va mos keladigan buyruq nomlarini ro'yxatga oladi.
Ovi tahlili, 2026-yil 21-oktyabrda e'lon qilingan, Doctor Web topilmalarini eslatmaydi, Doctor Web esa to'plamni nomlamagan. To'plam ishlab chiqaruvchilari yoki ularning mijozlaridan biri Doctor Web kuzatgan kampaniyani o'tkazganmi, aniq emas.
Kim Xavf Ostida
Buzilgan ilovalar sideloading orqali tarqaladi — bu odam ilova faylini to'g'ridan-to'g'ri o'rnatishi, ilova do'konidan emas — va ijtimoiy muhandislik orqali, deb topdi Ovi. U har bir jabrlanuvchi qanday zararlanganini tasdiqlay olmadi.
Ikkinchi yo'l — to'plam ishlab chiqaruvchilarning o'z konteyner ilovasi, 洋葱盒子 ("Piyoz Qutisi") deb nomlangan, u boshqa ilovalarni o'z ichida ishlatadi.
Buzilgan Telegram X nusxalarining ba'zilari Google Play'dagi haqiqiy ilova bilan bir xil paket nomidan foydalanadi, shuning uchun nomning o'zi ularni fosh qilmaydi.
Doctor Web Baohuo nusxalari 2024-yil o'rtalaridan beri soxta ilova do'kon saytlariga olib boradigan ilova ichidagi reklama orqali tarqalganini topdi. Bu saytlar Telegram X-ni tanishuv va video suhbat ilovasi sifatida targ'ib qilgan.
Sayt bannerlari faqat portugal tilida, Braziliya foydalanuvchilari uchun, va indonez tilida mavjud edi. Shunga qaramay, Doctor Web'ning 2025-yildagi zararlangan qurilmalar bo'yicha mamlakat xaritasi Hindistonni birinchi o'rinda, 22,8%, Braziliya 20,5% va Indoneziya 9,6% oldida qo'ydi.
Baohuo nusxalari uchinchi tomon do'konlari APKPure, ApkSum va AndroidP'da ham paydo bo'ldi. APKPure'da biri rasmiy ishlab chiquvchining nomi ostida ro'yxatga olingan, garchi uning raqamli imzosi boshqacha bo'lsa ham.
Ovi to'plamning buyruq serverlaridan biriga kirish huquqini oldi. U Xitoy va AQShda joylashgan ko'rinadigan jabrlanuvchilar haqidagi ma'lumotlarni saqlagan, lekin ishonchli hisoblash uchun yetarli emas. U o'z hisobotini "jabrlanuvchi ta'sirini o'lchash emas, texnik imkoniyat tahlili" deb ataydi.
Ko'rinadigan, hali tasdiqlanmagan nishonlar — Xitoy va Janubi-Sharqiy Osiyoda mobil hamyonlar va xabar almashish ilovalari foydalanuvchilari, jumladan WeCom, QQ, WhatsApp, LINE, Zalo, KakaoTalk, Viber, GCash va MoMo. U taxminan 20 ta ilovani qo'llab-quvvatlovchi kodni topdi, lekin faqat Telegram va WeChat uchun kodni e'lon qildi.
To'plamning hooking dvigateli — bu uning kodiga ilova funksiyalarini ushlab qolish imkonini beradigan qism. Ovi uni Android 17 bilan ishlaydigan Pixel 10 Pro'da tekshirdi. U yangi Android versiyalari bu funksiyani o'zgartirgani uchun, o'ziga kerak bo'lgan ichki Android funksiyasini topa olmadi.
Boshqa vosita, Frida, o'sha telefonda ilovalarni xuddi shu tarzda ushlab qolishi mumkin edi. Shuning uchun Ovi buni to'plam ishlab chiqaruvchilari uchun qo'shimcha ish deb ta'riflaydi, Android 17 hujumni to'sib qo'yishi isboti emas.
Eng yangi namuna, 2026-yil 29-iyul sanali, hali ham eski dvigatelni o'z ichiga olgan. U Android 16 uchun qurilgan namunalarni tikladi, lekin bu versiyani sinovdan o'tkazganini xabar qilmadi. U Xitoy ishlab chiqaruvchilarining telefonlarini sinovdan o'tkazmagan.
Telegram Hisobini Qanday Egallaydi
Buzilgan Telegram ilovasi ichida to'plam kodi ilova bilan birga boshlanadi va ilovaning o'z shaxsi va ruxsatlari bilan ishlaydi, deb topdi Ovi. Bu unga kirgan ilova bilan bir xil kirish huquqini beradi.
Har bir buzilgan ilova o'z ichida mahalliy buyruq serverini ham ishlatadi. Har bir nishon ilova uchun kod o'rnatishdan keyin yuklab olinadi, bu o'rnatuvchi faylni o'z-o'zidan tahlil qilishni qiyinlashtiradi.
Hujumchilar ilovaning xabar do'koniga har qanday ma'lumotlar bazasi so'rovini yuborishi va suhbat tarixini qaytarib olishi mumkin.
Telegram'ning ikki bosqichli tekshirish (2FA) paroli ilovada kiritiladi, u uni telefonda kirish isbotini yaratish uchun ishlatadi. To'plam bu qadamni ushlab qoladi va parolni ilova uni xesh qilmasdan oldin o'qiladigan shaklda nusxalaydi.
Parol bilan kod hisobning kirgan sessiyalarini qayta o'rnatishi, bog'langan telefon raqamini o'zgartirishi yoki hisobni o'chirishi mumkin. Kodning boshqa qismlari egasini bloklash, lekin hujumchining sessiyasini faol saqlash uchun mo'ljallangan.
Kod shuningdek hujumchining sessiyasini buzilgan ilova foydalanuvchiga ko'rsatadigan qurilma ro'yxatidan yashirishi mumkin.
Doctor Web'ning Baohuo tavsifi xuddi shu qurilma yashirishni qamrab oladi. Orqa eshik shuningdek har uch daqiqada hisobning telefon raqami, nomi va parolini o'z serveriga yuboradi.
Na Ovi, na Doctor Web yashirin sessiya foydalanuvchining boshqa, buzilmagan Telegram ilovalarida hali ham paydo bo'lishini aytmaydi. Hech biri bu tarzda egallab olingan hisobni xavfsiz qilish bo'yicha qadamlarni bermaydi.
Ovi kod to'plam nima qila olishini ko'rsatadi, lekin hujumchilar har bir qadamni boshidan oxirigacha ishlatganini emas, deb aytadi.
Oldingi Android zararli dasturlari ham qonuniy ilovalarni hujumchi kodi bilan birga ishlatgan. FjordPhantom 2023-yilda bank ilovalariga virtualizatsiya orqali shunday qilgan, 2025-yilda GodFather bank trojani ham shunday qilgan.
Ovi to'plam boshqacha, chunki u mahsulot sifatida sotiladi, deb ta'kidlaydi. Mijozlar uni ishlab chiqaruvchilar yozgan modul uchun har qanday ilovaga qarshi masofadan boshqarishi mumkin.
WeChat Qismi va Sizib Chiqgan Orqa Tomon
WeChat uchun to'plam ilova virtualizatsiyasidan ham foydalanishi mumkin — o'zgarmagan ilovani o'z konteynerida ishlatadi, deb topdi Ovi. Buyruq hisobning kirish shaxsini nusxalaydi. Ilova ma'lumotlari keyin ziplanadi va yuklanadi, va klonlash uchun birlashtirilgan kirish skripti ishlatiladi.
Bu qism suhbat tarixiga emas, hisobning o'ziga qaratilgan.
Ovi va boshqa tadqiqotchi Jurre shuningdek to'plam ortidagi orqa tomon kodini o'z-o'zidan joylashtirilgan GitLab serverida topdi. Bu sozlamaning tasdiqlangan IP manzillar bilan cheklanmagan yagona qismi edi.
Kod savdogarlar va qayta sotuvchilar ijaraga oladigan bulut konsolini ko'rsatadi. Har bir buyruq mijozning ID'sini o'z ichiga oladi, shuning uchun har bir mijoz o'z telefon parkini o'zi tanlagan jabrlanuvchilarga qaratadi.
Buyruqlar to'plamning telefon fermasidagi telefonlarga — operatsiya nazorat qiladigan telefonlar to'plami — va jabrlanuvchilarning telefonlariga yuboriladi. U yerda to'plam kirish ruxsatlarini ushlab qoladi, do'stlarni ommaviy ravishda qo'shadi, aloqa va profil ma'lumotlarini yig'adi va butun hisoblarni zaxiralaydi.
Rejalashtiruvchi vaqt oynalarini, tasodifiy kunlik cheklovlarni va har bir hisob uchun byudjetlarni belgilaydi, shuning uchun faoliyat insoniy ko'rinadi va platformalarning xavf tekshiruvlaridan o'tadi. Kod buni "hisob yetishtirish" deb ataydi, Ovi tarjimasida.
Taxminan uch o'nlab ishlab chiquvchilar, barchasi Xitoy vaqti bilan ishlaydigan, kod tarixida paydo bo'ladi va ba'zilari 2026-yil oktyabrda ham o'zgarishlar qo'shishda davom etgan.
Sizib chiqqan orqa tomon shaxsiy WeChat va WeCom hisoblarini qamrab oladi. Ovi u Telegramni qamrab olmagandek ko'rinadi, deb aytadi va bir nechta GitLab serverlaridan faqat bittasi ochiq edi.
Kim Orqada
Ovi operatsiyaning qismlarini Xitoyning Hunan viloyatidagi uchta kompaniyaga bog'laydi. Biri to'plamning brend veb-sayti va server sertifikati bilan bog'liq, ikkinchisi buyruq serveri uchun hukumat veb-sayt fayl bilan, uchinchisi esa to'plamning Windows boshqaruv dasturidagi imzo bilan.
U umumiy egasi "ehtimol, lekin hali isbotlanmagan" deb aytadi.
Ishlab chiqaruvchilarning o'z mahsulot nomi YingGai, va mahsulot liniyasi 2021-yil sentyabrga borib taqaladigan yozuvlarda paydo bo'ladi. Ovi o'rgangan namunalar 2024-yildan 2026-yil iyulgacha sanalarga tegishli.
Ovi to'plam moliyaviy motivatsiyali jinoyat uchun ishlatiladi, deb taxmin qiladi, chunki u hamyonlar va bir martalik parollarga qaratilgan. Doctor Web Baohuo-ni "Telegram kanallarida obunachilar sonini oshirish vositasi" deb ta'riflagan.
Zararlanish Ko'rsatkichlari
To'plam telefonda Ovi ishonchli deb ataydigan ikkita iz qoldiradi. Biri — ba'zi buzilgan Telegram nusxalarining aktivlarida TgJarPine.dex kod fayli. Ikkinchisi — LSPatch, tayyor patchlash vositasi, cache/lspatch/origin/*.apk da qoldirgan asl ilova nusxasi.
Bu ikkinchi iz LSPatch'ning o'zidan kelgani uchun, u boshqa sabablarga ko'ra vosita bilan patchlangan ilovalarda ham paydo bo'lishi mumkin.
The Hacker News 2026-yil 23-oktyabrda DNS yozuvlarini tekshirganida, to'plamning bir nechta server va yuklab olish domenlari endi hal qilinmadi. Uning versiya yuklash serveri domeni hali ham 121.37.194[.]194 ga ishora qilardi.
To'plam ko'rsatkichlari quyidagilarni o'z ichiga oladi:
- SHA-256:
2fc4bad71eda25b9022ea7cb090d6419911ecd67e50e746b418f8a617a980301(com.ucreator.tg, framework va buyruq ishlovchilari) - SHA-256:
0142749a159be3e41d28f910eebf28b577a282880bd0c2383bd7404189f4ff94(com.uckj.tgx, yuklovchi) - SHA-256:
dcec9640271a782553599197bcb85367971a5bb4aa84c3787d1e49a3f4f9420e(org.thunderdog.challegram, buzilgan Telegram X, 2024-yil noyabr) - SHA-256:
805834e6b8c12e180117a1816b48e387c33b53520f5a91cbf858441dc895e717(org.telegram.messenger.web, buzilgan Telegram, 2024-yil iyul) - SHA-256:
a90e3ab2b5cf306439a378faf7107a89196116ad7ee4ad5791c2ba8839ba21c4(org.thunderdog.challegram, buzilgan Telegram X) - SHA-256:
f82ac2c525d1ed82e57b3f27ae689aeda46875a893ca4c42876b3166ba66bb20(com.ucreator.va_vx, WeChat xosti) - SHA-256:
99c5be579d218acfd2c7e2662528e7ad32a1a605d8efd1da732c13931bc30c4c(com.ucreator.vayjbclient, Piyoz Qutisi) - SHA-256:
9c8b147f76312e651faabb1411a3270efca984dd8f33bd8ded3ea611c7c583a1(uip.exe, Windows boshqaruv dasturi) - Domen:
hpncallback.gold5play[.]com(buyruq serveri, 23-oktyabrda hal qilinmadi) - Domen:
hpncallback.qianxunlbs[.]com(buyruq serveri, 23-oktyabrda hal qilinmadi) - Domen:
telegram-apk.uzyzx[.]com(yuklab olish xosti, 23-oktyabrda hal qilinmadi) - Domen:
hw.android.videoflow[.]cn(versiya yuklashlari, 23-oktyabrda 121.37.194[.]194 ga ishora qilardi) - IP:
159.138.237[.]10:32115(Redis serveri) - IP:
159.138.229[.]12:26379(Redis serveri) - Domen:
r-bp1jehsclgbuu48m7tpd.redis.rds.aliyuncs[.]com:65531(Redis serveri, WeChat qismi) - IP:
43.225.141[.]209(Telegram qismi ishlatadigan relay) - URL:
kfpt.oss-cn-hangzhou.aliyuncs[.]com/android/app/YingGai/(hook yuklab olishlari)
Doctor Web Baohuo uchun o'z ko'rsatkichlarini e'lon qilgan.
A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who install one of these tampered copies, spread outside the official app stores, or who run WeChat inside the kit makers' own container app.
The kit's Telegram part matches Baohuo, a backdoor that Doctor Web reported in October 2025. Doctor Web found Baohuo in tampered copies of Telegram X, an Android app from Telegram. At the time, the company estimated that more than 58,000 devices were infected.
The Hacker News compared the two reports. Doctor Web's technical description of Baohuo lists the same code namespace, com.ucreator.tgjar, the same command-and-control (C2) server, and matching command names as Ovi's analysis.
Ovi's analysis, published October 21, 2026, does not mention Doctor Web's findings, and Doctor Web did not name the kit. It is not clear whether the kit's makers or one of their customers ran the campaign Doctor Web tracked.
Who Is Exposed
The tampered apps spread through sideloading, where a person installs an app file directly instead of from an app store, and through social engineering, Ovi found. He could not confirm how every victim was infected.
A second route is the kit makers' own container app, called 洋葱盒子 ("Onion Box"), which runs other apps inside itself.
Some of the tampered Telegram X copies use the same package name as the real app on Google Play, so the name alone does not give them away.
Doctor Web found that Baohuo copies had been spreading since mid-2024 through in-app ads that led to fake app store sites. Those sites promoted Telegram X as a dating and video chat app.
The sites' banners were available only in Portuguese, for users in Brazil, and in Indonesian. Even so, Doctor Web's 2025 map of infected devices by country put India first, at 22.8%, ahead of Brazil at 20.5% and Indonesia at 9.6%.
Baohuo copies also turned up in the third-party stores APKPure, ApkSum and AndroidP. On APKPure, one was listed under the official developer's name, although its digital signature was different.
Ovi got access to one of the kit's command servers. It held data on victims apparently located in China and the United States, but not enough for a reliable count. He calls his report "an analysis of technical capability, not a measurement of victim impact."
The apparent targets, still unconfirmed, are users of mobile wallets and messaging apps in China and Southeast Asia, including WeCom, QQ, WhatsApp, LINE, Zalo, KakaoTalk, Viber, GCash and MoMo. He found code supporting about 20 apps, but has published code only for Telegram and WeChat.
The kit's hooking engine is the part that lets its code intercept an app's functions. Ovi checked it on a Pixel 10 Pro running Android 17. It could not find an internal Android function it relies on, because newer Android versions changed that function.
Another tool, Frida, could still hook apps the same way on that phone. Ovi therefore describes this as extra work for the kit's makers, not proof that Android 17 blocks the attack.
The newest sample, dated July 29, 2026, still carried the old engine. He recovered samples built for Android 16 but did not report testing that version. He has not tested phones from Chinese makers.
How It Takes Over a Telegram Account
Inside a tampered Telegram app, the kit's code starts with the app and runs with the app's own identity and permissions, Ovi found. That gives it the same access as the signed-in app.
Each tampered app also runs a local command server inside itself. The code for each target app is downloaded after installation, which makes the installer file harder to analyze on its own.
Attackers can send any database query to the app's message store and get chat history back.
Telegram's two-step verification (2FA) password is entered in the app, which uses it to generate a login proof on the phone. The kit hooks that step and copies the password in readable form before the app hashes it.
With the password, the code can reset the account's logged-in sessions, change the linked phone number, or delete the account. Other parts of the code are designed to lock out the owner while keeping the attacker's session alive.
The code can also hide the attacker's session from the device list that the tampered app shows the user.
Doctor Web's description of Baohuo covers the same device-hiding. The backdoor also sends the account's phone number, name and password to its server every three minutes.
Neither Ovi nor Doctor Web says whether a hidden session still appears on the user's other, untampered Telegram apps. Neither gives steps for securing an account taken over this way.
Ovi says the code shows what the kit can do, not that attackers have used every step from start to finish.
Earlier Android malware has also run legitimate apps with attacker code inside them. FjordPhantom did this to banking apps through virtualization in 2023, and so did the GodFather banking trojan in 2025.
Ovi argues the kit is different because it is sold as a product. Customers can steer it remotely against any app its makers write a module for.
The WeChat Part and the Leaked Back End
For WeChat, the kit can also use app virtualization, running the unchanged app inside its own container, Ovi found. A command copies out the account's login identity. The app's data is then zipped and uploaded, and a bundled login script is used to clone the account.
This part goes after the account itself, not its chat history.
Ovi and another researcher, Jurre, also found the back-end code behind the kit on a self-hosted GitLab server. It was the one part of the setup not limited to approved IP addresses.
The code shows a cloud console that merchants and resellers rent. Every command carries the customer's ID, so each customer aims its own share of the phone fleet at victims it picks.
Commands go to phones in the kit's phone farm, a set of phones the operation controls, and to victims' phones. There, the kit captures login authorizations, adds friends in bulk, collects contact and profile data, and backs up whole accounts.
A scheduler sets time windows, random daily limits, and per-account budgets, so the activity looks human and gets past the platforms' risk checks. The code calls this "account cultivation," in Ovi's translation.
About three dozen developers, all working on China time, appear in the code's history, and some were still adding changes in October 2026.
The leaked back end covers personal WeChat and WeCom accounts. Ovi says it did not appear to cover Telegram, and only one of several GitLab servers was exposed.
Who Is Behind It
Ovi ties parts of the operation to three companies in Hunan province, China. One is linked to the kit's brand website and a server certificate, another to a government website filing for a command server, and the third to the signature on the kit's Windows control program.
He says a shared owner is "plausible, but remains unproven."
The makers' own name for the product is YingGai, and the product line appears in records dating back to September 2021. The samples Ovi studied date from 2024 to July 2026.
Ovi assumes the kit is used for financially motivated crime, given its focus on wallets and one-time passcodes. Doctor Web described Baohuo as "a tool for boosting the number of subscribers in Telegram channels."
Indicators of Compromise
The kit leaves two traces on a phone that Ovi calls reliable. One is a code file, TgJarPine.dex, in the assets of some tampered Telegram copies. The other is the original app copy that LSPatch, an off-the-shelf patching tool, leaves at cache/lspatch/origin/*.apk.
Because that second trace comes from LSPatch itself, it can also appear in apps patched with the tool for other reasons.
When The Hacker News checked DNS records on October 23, 2026, several of the kit's server and download domains no longer resolved. The domain for its version-upload server still pointed to 121.37.194[.]194.
The kit's indicators include:
- SHA-256:
2fc4bad71eda25b9022ea7cb090d6419911ecd67e50e746b418f8a617a980301(com.ucreator.tg, framework and command handlers) - SHA-256:
0142749a159be3e41d28f910eebf28b577a282880bd0c2383bd7404189f4ff94(com.uckj.tgx, loader) - SHA-256:
dcec9640271a782553599197bcb85367971a5bb4aa84c3787d1e49a3f4f9420e(org.thunderdog.challegram, tampered Telegram X, November 2024) - SHA-256:
805834e6b8c12e180117a1816b48e387c33b53520f5a91cbf858441dc895e717(org.telegram.messenger.web, tampered Telegram, July 2024) - SHA-256:
a90e3ab2b5cf306439a378faf7107a89196116ad7ee4ad5791c2ba8839ba21c4(org.thunderdog.challegram, tampered Telegram X) - SHA-256:
f82ac2c525d1ed82e57b3f27ae689aeda46875a893ca4c42876b3166ba66bb20(com.ucreator.va_vx, WeChat host) - SHA-256:
99c5be579d218acfd2c7e2662528e7ad32a1a605d8efd1da732c13931bc30c4c(com.ucreator.vayjbclient, Onion Box) - SHA-256:
9c8b147f76312e651faabb1411a3270efca984dd8f33bd8ded3ea611c7c583a1(uip.exe, Windows control program) - Domain:
hpncallback.gold5play[.]com(command server, not resolving on October 23) - Domain:
hpncallback.qianxunlbs[.]com(command server, not resolving on October 23) - Domain:
telegram-apk.uzyzx[.]com(download host, not resolving on October 23) - Domain:
hw.android.videoflow[.]cn(version uploads, pointing to 121.37.194[.]194 on October 23) - IP:
159.138.237[.]10:32115(Redis server) - IP:
159.138.229[.]12:26379(Redis server) - Domain:
r-bp1jehsclgbuu48m7tpd.redis.rds.aliyuncs[.]com:65531(Redis server, WeChat part) - IP:
43.225.141[.]209(relay used by the Telegram part) - URL:
kfpt.oss-cn-hangzhou.aliyuncs[.]com/android/app/YingGai/(hook downloads)
Doctor Web has published its own indicators for Baohuo.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.