---
title: "uCreator: a spyware that runs inside mobile applications"
description: Analysis of uCreator, an Android spy kit rented to resellers that runs inside legitimate applications, and the protections publishers should put in place.
image: https://blog.pradeo.com/hubfs/visuel_1170x480.png
---
[](https://pradeo.com)
- Solutions
MOBILE DEVICE SECURITY - [Mobile Threat Defense](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/)
- [Secure Private Store](https://pradeo.com/en/solutions/mobile-device-security/secure-private-store/)
MOBILE APPLICATION SECURITY - [Mobile Application Compliance Audit](https://pradeo.com/en/solutions/mobile-application-security/application-compliance-audit/)
- [Runtime Application Self Protection](https://pradeo.com/en/solutions/mobile-application-security/rasp/)
- [Shielding](https://pradeo.com/en/solutions/mobile-application-security/application-shielding/)
- [Application Security Testing](https://pradeo.com/en/solutions/mobile-application-security/application-security-testing/)
- Use cases
- [Cybersecurity in MDM/ UEM](https://pradeo.com/en/use-cases/cybersecurity-in-mdm-uem/)
- [Securing mobile devices](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/)
- [Securing Mobile Applications](https://pradeo.com/en/solutions/mobile-application-security/application-security-testing/)
- [Malware / leakware protection](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/)
- [Phishing protection](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/)
- [Ensuring compliance for applications](https://pradeo.com/en/compliance/)
- [Ensuring compliance for mobile fleet](https://pradeo.com/en/compliance/)
- [Securing BYOD](https://pradeo.com/en/solutions/mobile-device-security/secure-private-store/)
- [Become partner](https://pradeo.com/become-partner/)
- Resources
- [Solution briefs](https://pradeo.com/en/resources/?solution-briefs)
- [Customer Cases](https://pradeo.com/en/resources/?customer-cases)
- [Integration briefs](https://pradeo.com/en/resources/?integration-briefs)
- [White Papers](https://pradeo.com/en/resources/?white-papers)
- [Analyst reports & guides](https://pradeo.com/en/resources/?analyst-reports-guides)
- [On demand webcast](https://pradeo.com/en/resources/?webcasts-on-demand)
- [About us](https://pradeo.com/en/about/)
- [Blog](https://blog.pradeo.com/)
- [Contact](https://pradeo.com/contact/)
- en
- [**FR**](https://blog.pradeo.com/fr)
- [**DE**](https://blog.pradeo.com/de)
### Topics
- Select a Topic
- [All](https://blog.pradeo.com)
- [Mobile Security](https://blog.pradeo.com/topic/mobile-security)
- [Mobile Application Security](https://blog.pradeo.com/topic/mobile-application-security)
- [Expertise](https://blog.pradeo.com/topic/expertise)
- [News](https://blog.pradeo.com/topic/news)
- [Security Alert](https://blog.pradeo.com/topic/security-alert)
- [Cybersecurity](https://blog.pradeo.com/topic/cybersecurity)
- [Partners](https://blog.pradeo.com/topic/partners)
- [Corporate](https://blog.pradeo.com/topic/corporate)
- [Events](https://blog.pradeo.com/topic/events)
- [Actualité](https://blog.pradeo.com/topic/actualité)
- [predictions](https://blog.pradeo.com/topic/predictions)
- [cyberattack](https://blog.pradeo.com/topic/cyberattack)
### Stay up to date
SUBSCRIBE TO OUR BLOG
### Stay up to date
[News](https://blog.pradeo.com/topic/news)
# uCreator: a spyware that runs inside mobile applications
By [Julie LAURENT](https://blog.pradeo.com/author/julie-laurent) on November, 5 2026
[mailto:?subject=Take%20a%20look%20at%20this%20article](mailto:?subject=Take%20a%20look%20at%20this%20article)
uCreator, an Android spyware kit offered for rent, was the subject of an [analysis in October 2026](https://www.0x0v1.com/ucreator-virtualization-based-android-spyware-platform-targeting-wechat-telegram-and-other-messaging-apps/). How does it operate? It does not just display a fake screen on top of a legitimate app, it installs itself inside. Once in place, it can read conversations, steal the two-factor authentication password and take over accounts. A threat that directly concerns every mobile app publisher.
## A commercial platform active for several years
uCreator is presented as a commercial, turnkey product. Resellers rent a cloud console to control infected devices. Each command carries the customer's ID, allowing each one to manage its own scope. A scheduler spreads activity across time slots, with random daily caps, so that hijacked accounts appear to behave like real people. The first traces of the product date back to September 2021, and the samples analyzed range from 2024 to July 2026.
## How uCreator gets inside the application
uCreator runs inside the real application, exploiting its interface, logic and data. To do so, it takes two paths.
- **Repackaging**: attackers distribute a modified version of the real app, notably Telegram, with their spy code built in.
- **Virtualization**: for WeChat, the kit can run the original, unmodified app inside a container it controls.
## What uCreator can do
Once in place, uCreator operates [with the identity and permissions of the targeted app](https://thehackernews.com/2026/10/ucreator-android-spyware-can-steal.html). It opens a local command server, through which the operator controls the device, and downloads the functions specific to each targeted app after installation. The available commands are numerous.
- **Read conversations**: it can directly query the app's message database.
- **Steal two-factor authentication**: on Telegram, it copies the password in clear text, before it is even hashed.
- **Take over the account**: with this password, it can reset sessions, change the linked phone number or delete the account.
- **Clone the identity**: on WeChat, it extracts the account's login identity and reuses it on another device using a script supplied with the kit.
- **Stay discreet**: it removes its own session from the victim's list of connected devices and can block some of the app's notifications.
## Around twenty apps in the crosshairs
The analysis only details two apps, Telegram and WeChat, but the code discovered supports around twenty. Apparent targets include WeCom, QQ, WhatsApp, LINE, Zalo, KakaoTalk, Viber and the mobile wallets GCash and MoMo, although this has not been confirmed. Identified victims appear to be located in China and the United States, but the data does not make it possible to establish how many there are.
The trapped apps spread through direct downloads or social engineering, outside official stores. On Telegram, uCreator [shares the same characteristics as Baohuo](https://thehackernews.com/2026/10/ucreator-android-spyware-can-steal.html), a backdoor described in October 2025: same code, same command server, same commands. Baohuo spread through ads leading to fake app stores, and was also spotted on alternative platforms such as APKPure. By October 2025, it had already [infected more than 58,000 devices](https://news.drweb.com/show/?i=15076&lng=en).
## An impact that goes beyond the user
For the victim, the consequence can be the loss of their account: messages read, identity cloned, account deleted. For the publisher, a copy of its own app becomes the attack vector. This copy keeps the look, the functionality and the user's trust, which makes the attack harder to notice. And Android hardening is not enough to protect the app: on Android 17, the analysis shows that intercepting its functions remains technically possible.
## Banking apps are also targeted
Other groups exploit app cloning, including against banks. In September 2026, [the GoldFactory group's modus operandi was analyzed](https://www.group-ib.com/blog/vwork-app-cloning-gigabud-goldfactory/). After taking control of the phone with the Gigabud trojan, fraudsters install Vwork, a tool that runs the victim's banking app inside an Android work profile. Because this profile is isolated from the personal profile, the infection can go unnoticed there, and the bank may see a transaction coming from a new device, with no link to the infection.
In Indonesia, between February and July 2026, around 1,469 compromised devices and nearly $961,000 in estimated losses were observed. App cloning is not new, but criminal groups are now building it into their toolkits: the app itself is turned against its own customers.
## How Pradeo protects mobile apps
Faced with these techniques, a publisher can rely neither on the operating system alone nor on the vigilance of its users. The app must be able to verify that it is authentic and that it runs in a trusted environment. Pradeo covers this need, from testing to runtime.
- **Audit with MAST.** Pradeo's [Mobile Application Security Testing](https://pradeo.com/en/solutions/mobile-application-security/mobile-application-security-testing/) analyzes the app's binary code and the libraries it embeds. It reveals the app's vulnerabilities, behaviors, data leaks and trackers. Publishers can fix flaws before an attacker exploits them.
- **Harden with Shielding.** [Application Shielding](https://pradeo.com/solutions/mobile-application-security/application-shielding/) obfuscates the code, encrypts strings and resources, and removes debug information. It also includes an integrity check. A trapped copy like those spread by uCreator becomes more costly to produce, and the modified app detects the tampering and responds.
- **Respond with RASP.** [Runtime Application Self Protection (RASP)](https://pradeo.com/solutions/mobile-application-security/rasp/) detects threats on the device from within the app: screen overlays, keylogging, unsecured connections, a tampered system or execution in an emulator. The app responds in real time according to the rules set by the publisher.
###### About The Author
[More from this author](https://blog.pradeo.com/author/julie-laurent)
###### Julie LAURENT
#### Recommended articles
[](https://blog.pradeo.com/espionage-mobile-devices-are-prime-targets)
###### [Espionage: mobile devices are prime targets](https://blog.pradeo.com/espionage-mobile-devices-are-prime-targets)
\- October 29, 2026
[-1.png)](https://blog.pradeo.com/data-control-why-hosting-your-data-locally-isnt-enough)
###### [Data control: why hosting your data locally isn't enough](https://blog.pradeo.com/data-control-why-hosting-your-data-locally-isnt-enough)
\- October 8, 2026
### Popular articles
### Stay up to date
### Recent articles
### Articles récents
[uCreator: a spyware that runs inside mobile applications](https://blog.pradeo.com/ucreator-a-spyware-that-runs-inside-mobile-applications)
\- 5 November, 2026
[Espionage: mobile devices are prime targets](https://blog.pradeo.com/espionage-mobile-devices-are-prime-targets)
\- 5 November, 2026
[Shizuku, the legitimate tool that gives malware access to Android](https://blog.pradeo.com/shizuku-the-legitimate-tool-that-gives-malware-access-to-android)
\- 5 November, 2026
[Data control: why hosting your data locally isn't enough](https://blog.pradeo.com/data-control-why-hosting-your-data-locally-isnt-enough)
\- 5 November, 2026
[Fence integrates Pradeo's technology to secure its clients' mobile fleets](https://blog.pradeo.com/fence-integrates-pradeos-technology-to-secure-its-clients-mobile-fleets-1)
\- 5 November, 2026
### Topics
- [Mobile Security (56)](https://blog.pradeo.com/topic/mobile-security)
- [Mobile Application Security (46)](https://blog.pradeo.com/topic/mobile-application-security)
- [Expertise (32)](https://blog.pradeo.com/topic/expertise)
- [News (31)](https://blog.pradeo.com/topic/news)
- [Security Alert (30)](https://blog.pradeo.com/topic/security-alert)
- [Cybersecurity (29)](https://blog.pradeo.com/topic/cybersecurity)
- [Partners (25)](https://blog.pradeo.com/topic/partners)
- [Corporate (12)](https://blog.pradeo.com/topic/corporate)
- [Events (4)](https://blog.pradeo.com/topic/events)
- [Actualité (2)](https://blog.pradeo.com/topic/actualité)
- [predictions (2)](https://blog.pradeo.com/topic/predictions)
- [cyberattack (1)](https://blog.pradeo.com/topic/cyberattack)
see all
[](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/2378615/ad3111b0-9454-41ff-91f4-9eee95b1f08f)
### Get in touch with mobile security experts
[Contact us](https://www.pradeo.com/en-US/contact-us)
[](https://pradeo.com)
European leader in mobile security, Pradeo protects business mobile devices and applications.
[Read More](https://www.pradeo.com/en-US/)
- [Resources](https://www.pradeo.com/en-US/pradeo-ressources#white_papers)
- [UEM security](https://www.pradeo.com/en-US/uem-mdm-security)
- [Use cases](https://www.pradeo.com/en-US/pradeo-ressources#use-case)
- [Data protection](https://www.pradeo.com/en-US/mobile-data-privacy-regulation)
- [Contact us](https://www.pradeo.com/en-US/contact-us)
- [Mobile Threat Defense](https://www.pradeo.com/en-US/mobile-threat-defense)
- [Mobile Application Security Testing](https://www.pradeo.com/en-US/application-security-testing)
- [In-App Protection](https://www.pradeo.com/en-US/in-app-protection)
- [Secure Private Store](https://www.pradeo.com/en-US/private-app-store)
- [Mobile Threat Intelligence](https://www.pradeo.com/en-US/mobile-threat-intelligence#perso-threat-intelligence)
[contact@pradeo.com](mailto:contact@pradeo.com)
Copyright @ 2022. All Right Reserved.
-
-
-
```json
{
"@context" : "http://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Julie LAURENT"
},
"dateModified" : "November 5, 2026, 11:09:44 AM",
"datePublished" : "2026-11-05 10:49:04",
"description" : "Analysis of uCreator, an Android spy kit rented to resellers that runs inside legitimate applications, and the protections publishers should put in place.",
"headline" : "uCreator: a spyware that runs inside mobile applications",
"image" : {
"@type" : "ImageObject",
"url" : "https://2378615.fs1.hubspotusercontent-eu1.net/hubfs/2378615/visuel_1170x480.png"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://2378615.fs1.hubspotusercontent-eu1.net/hubfs/2378615/Logo%20Pradeo%20D%C3%A9grad%C3%A9%20Long%20Couleurs.svg"
},
"name" : "Pradeo"
}
}
```