Researcher details uCreator Android malware posing as Telegram, WeChat
The malware repackages legitimate messenger apps and is run as a malware-as-a-service offering, according to an analysis published by researcher Ovi.
A security researcher known as Ovi has published an analysis of uCreator, an Android malware family that disguises itself as messenger apps to steal account credentials and authentication data, according to dailysecu.com.
uCreator repackages legitimate messenger apps with malicious features and redistributes them outside official app stores. The tampered apps keep most of the original messenger functions, which makes the malicious behaviour hard to notice.
The malware is built to collect messenger account credentials, messages and authentication-related data. Among its targets are Telegram two-step verification passwords and WeChat account information.
The analysis describes uCreator as a malware-as-a-service offering that supplies attack functions to other criminals. Some of its techniques resemble those of Baohuo, malware that security firm Dr.Web previously disclosed.
In that earlier case, Dr.Web analyzed a large-scale infection campaign spread through tampered Telegram apps. The damage figure from that campaign does not represent new uCreator infections.
Quick answers
What is uCreator?
It is an Android malware family that repackages legitimate messenger apps with malicious features and distributes them outside official app stores.
Which apps does uCreator target?
It collects messenger credentials, messages and authentication data, including Telegram two-step verification passwords and WeChat account information.
Who published the analysis?
The analysis was published by a security researcher named Ovi and reported by dailysecu.com.