Researcher Ovi published an analysis on 21 October 2026 of uCreator (the vendor's own name for the product is YingGai), which he describes as a commercial Android surveillance platform that customers can rent and deploy against different apps on a target device.

According to Ovi, victims get it through repackaged copies of legitimate apps, including Telegram variants, WeChat and GCash, spread by sideloading or social engineering, or through the vendor's own container app, Onion Box; much of the target-specific code is downloaded after installation.

He says the Telegram module can run database queries through the app's own live interface, capture the account's two-step-verification password in cleartext, and remove its own session from the victim's device list, which together could support account takeover and hiding the intrusion; the WeChat flow harvests and zips app data and uses a bundled login script to clone the account.

Ovi says he found code-confirmed support for about 20 target apps and that the apparent (still unconfirmed) targets are users of mobile wallets and messaging apps across China and Southeast Asia.

He stresses that his report is an analysis of technical capability, not a measurement of victim impact: a command server he accessed held victim-related data apparently from China and the United States, but no reliable victim count. With another researcher, Jurre, he found the operators' back-end source code on an exposed self-hosted GitLab server. He associates three companies in Changsha and Hunan, China with different parts of the operation and says a shared owner is plausible but unproven.

On Android 17 he found the kit's bundled hooking engine fails a symbol lookup, which he calls compatibility work for the makers, not proof that Android 17 prevents the technique.

According to The Hacker News (26 Oct), the kit's Telegram part matches Baohuo, a backdoor Doctor Web reported in October 2025 in tampered copies of Telegram X. Primary: Ovi (0x0v1.com); wire: The Hacker News.