Ovi, a researcher who has been tracking the platform under that handle, puts uCreater in a category of its own: Android spyware rented out as a service and delivered as tampered copies of everyday messaging and wallet software. Behind it sits a framework called YingGai, which lifts one-time passcodes, pulls account and chat records, scrapes address books, rides existing sessions and feeds a fake camera image to defeat identity checks.
Getting it installed means sideloading or talking a target into a rebuilt Telegram, WeChat or GCash. The planted APK stays small on purpose, fetching the target-specific portion from operator storage on Alibaba OSS and MinIO, in buckets labeled Huuk_<target> and fengzhuang-app.
Older than the files that prove it
Records stretch back far beyond the samples: com.ucreater.autotool around 2014, Windows tooling on ucreater.com signed from 2016 to 2019, and the YingGai mobile line from September 2021. What Ovi examined covers 2024 through 2026.
Footprint, if not victim numbers, points at something sold widely. Support is confirmed for around 20 apps. Message plumbing runs through three Redis buses and a pair of MQTT ones, six domains fan out into dozens of subdomains, and Changsha hosts a cluster of cloud handsets. Searching Censys for the operator’s Tengine gateway signature surfaced some 48 matching machines.
Attribution is unresolved. Names attached to the platform’s certificates and registrations include Hunan Youchuang Technology, Changsha Sukai Network and Changsha Zhuoqing E-commerce, and its gateway fingerprint matches a Hunan public-safety research institute, but Ovi found nothing showing that institute built or ran it.
Defenders on mobile should refuse sideloaded chat and wallet builds, watch for accessibility or screen-capture grants requested by messaging apps, and flag enrollment prompts that follow hard on a one-time code.
