Misconfigured GitLab server exposes uCreator spyware backend

Security researcher Ovi published a technical analysis of the uCreator Android spyware kit on Oct. 21, 2026. A misconfigured self-hosted GitLab server exposed the operation’s source code, configuration files and commit history across 13 repositories, and was the only part of the infrastructure not protected by an IP allowlist.

The exposed backend showed roughly 36 developers working on China Standard Time, with some still pushing commits in October 2026. Merchants and resellers rented the multi-tenant cloud console, and every command carried a customer identifier.

Ovi tied platform artifacts to three Hunan Province companies: Hunan Youchuang Technology Co., Ltd., Changsha Sukai Network Co., Ltd. and Changsha Zhuoqing E-commerce Co., Ltd. Hunan Youchuang Technology ties to the ucreater.com brand domain and a self-signed TLS certificate on videoflow.cn infrastructure. Changsha Sukai Network appears in the ICP (internet content provider) filing for the primary C2 (command-and-control) apex domain qianxuncc.cn, while Changsha Zhuoqing E-commerce appears as the Authenticode signing identity on uip.exe, the Windows operator console distributed to customers.

Active command-and-control infrastructure includes the apex domain qianxuncc.cn and subdomains of videoflow.cn. The version-upload server hw.android.videoflow.cn, resolving to IP 121.37.194.194, remained live through Oct. 23, 2026. Commands route through Kafka and RocketMQ to a phone farm in Changsha Hunan or to victims’ handsets, and exfiltrated data accumulates in Aliyun storage.

The uCreator Telegram module hooks the SRPHelper.getX method (a Telegram function that processes the two-factor password) to intercept the two-factor password in cleartext before the app hashes it, defeating Telegram’s SRP (Secure Remote Password) protocol. With the intercepted cleartext password, an operator can reset login sessions, change the linked phone number or delete the Telegram account. The code also hides the attacker’s active session from the device list shown to the Telegram user.

uCreator code runs inside the legitimate Telegram or WeChat process with the same access as the signed-in app and does not require root access. For WeChat, the platform harvests login identity through a VirtualApp sandbox and compresses the app data archive. The archive is uploaded to Aliyun object storage, and a bundled login script clones the account on an operator-controlled device.

The container app Onion Box, marketed under the Chinese name 法酵白子, runs an unmodified copy of WeChat inside a VirtualApp sandbox. Users may install this container app to run WeChat inside the operator’s environment. uCreator also hooks the Telegram application to run a local HTTP command server with roughly 40 numbered handlers, and it runs raw SQL queries against the live MessagesStorage database handle, bypassing disk encryption.

The platform combines VirtualApp, LSPatch and the Pine ART inline-hook engine to execute code inside another app’s container. Hook modules are fetched after installation from Alibaba OSS and MinIO using target-specific path identifiers prefixed Huuk_<target>. Code indicates uCreator can inject a controlled camera feed in place of the device’s actual camera output to bypass KYC liveness checks.

Ovi identified code supporting approximately 20 applications, including WeCom, QQ, WhatsApp, LINE, Zalo, KakaoTalk, Viber, GCash and MoMo. Ovi published deep technical review only for the Telegram and WeChat parts, so the longer list shows what the tool might do but does not prove attackers broke into every listed service.

The Pine hooking engine failed on a Pixel 10 Pro running Android 17 because newer Android versions use a modified C++ function signature that breaks the engine’s symbol lookup. Frida could still hook apps in-process on the same Android 17 device, so Ovi described the Pine failure as extra compatibility work, not proof that Android 17 blocks the attack class. The newest captured uCreator sample, dated July 29, 2026, still carried the old Pine engine.

Doctor Web’s Q4 2025 report estimated that the Baohuo campaign infected more than 58,000 devices since distribution began in mid-2024. Doctor Web’s report found Baohuo in tampered copies of Telegram X distributed through in-app ads leading to fake app store sites, with banners in Portuguese and Indonesian. Its infection map placed India first at 22.8 percent, ahead of Brazil at 20.5 percent and Indonesia at 9.6 percent.

Technical comparisons show Baohuo and uCreator share the code namespace com.ucreator.tgjar, the same command-and-control server and matching command names. Sources differ on whether the same operators ran both the Baohuo campaign and the uCreator rental kit. Neither Ovi nor Doctor Web confirmed that uCreator’s makers ran the Baohuo campaign or that a customer used the kit for it.

Ovi assessed the operation as financially motivated crimeware rather than state policing software, based on the resale console and wallet targets. Ovi said his report is “an analysis of technical capability, not a measurement of victim impact.”

Records show com.ucreater.autotool dates back to about 2014, while Windows tooling tied to ucreater.com carried signatures from 2016 through 2019. Records dated September 2021 include the YingGai mobile product line. Ovi could not confirm how each victim became infected and could not produce a reliable victim count from command server data, though recovered server data pointed to victims apparently located in China and the United States.

Baohuo copies also appeared in third-party stores APKPure, ApkSum and AndroidP, including one listed under the official developer’s name with a different digital signature. Doctor Web described Baohuo as a tool for boosting the number of subscribers in Telegram channels. Doctor Web described Baohuo inserting itself into Telegram X copies by modifying the main DEX file, dynamically injecting code with LSPatch, or loading a separate DEX file from app resources.

Doctor Web described Baohuo using a command-and-control server and Redis database for commands. The heartbeat sent account and device details every three minutes, with task requests every minute.

CISA issued guidance in November 2025 recommending messaging app users avoid SMS-based two-factor authentication and migrate to FIDO-compliant hardware keys or passkeys. China’s National Intelligence Law Article 7 (2017) requires all organizations and citizens to support national intelligence work, applying to the three Hunan companies. China’s Data Security Law (2021) requires data deemed relevant to national security or the national economy to be stored within China and accessible to government authorities.

Ovi advised installing messaging apps only from the official Google Play Store and changing Telegram two-factor passwords if the app did not come from the Play Store. Ovi advised revoking all Telegram sessions from a trusted device, changing the two-factor password and reinstalling Telegram from the Play Store if users suspect compromise. Ovi said users should avoid APKs from in-app ads, messaging links and third-party repositories including APKPure, ApkSum and AndroidP.