uCreator Spyware Infiltrates Modified Telegram, WeChat and GCash Builds on Android
Security researcher Ovi has published a detailed technical analysis of uCreator, also known as YingGai, a commercial Android spyware platform sold for surveillance and remote application management.
The toolset allows operators to intercept messages, one-time codes and account credentials directly inside legitimate apps without root access. One primary infection method involves modified builds of Telegram, WeChat and GCash distributed through third-party sources. An alternative vector uses the Onion Box container, inside which the target application is launched under the spyware’s control.
Additional modules can be downloaded after initial installation. Once running, the malicious code executes inside the host process. In Telegram it accesses the open message database through the client’s own interfaces. Researchers also identified functionality to capture two-factor authentication passwords and conceal the spyware’s own session from the user.
Behind the mobile components lies cloud-based infrastructure with customer-specific control panels. An exposed GitLab repository enabled partial reconstruction of the server-side code and development timeline. The number of victims is currently unknown, and full functionality on Android 17 has not been confirmed due to compatibility issues.
Because the compromised messenger can appear completely normal, users are advised to avoid installing modified APK files from untrusted sources.
Related articles
Fake GTA VI Installer Distributed via Google Colab Steals Steam Credentials and Crypto Wallet Data
Researchers at cybersecurity firm Cynet have uncovered a fake Grand Theft Auto VI installer for PC that targets Steam accounts and cryptocurrency wallets. The malware is promoted through a Google Colab notebook that leads users to a fraudulent WooCommerce store page called Windows Software Hub. The download archive contains only a small 796 KB executable and a README file instructing victims to run the file as administrator and disable security features. Once executed, the malware bypasses sandboxes and virtual machines, injects code into browser processes, and harvests passwords, cookies, browsing data, and crypto wallet information while also swapping clipboard addresses. The campaign coincides with growing scam activity around the unreleased title, which Rockstar Games has not yet scheduled for PC release. Earlier reports from Netcraft documented multiple GTA VI-related fraud schemes between July and October 2026.
Cloudflare Blocks 18.2 Million DDoS Attacks in Q3 2026 Amid Shifting Attack Patterns
Cloudflare reported blocking 18.2 million network-layer DDoS attacks between July and September 2026, marking a 208% increase from the same period in 2025. The company recorded an average of roughly 8,200 attacks per hour, with 96% lasting under ten minutes and 98% staying below 1 Gbps. Large-scale attacks exceeding 1 Tbps dropped sharply from 805 in Q2 to 251 in Q3, a decline Cloudflare links to early 2026 law enforcement actions against four IoT botnets. Attack vectors shifted notably, with CLDAP reflection falling 99.5% while DNS amplification rose 215% and UDP floods grew 122%. The United States led targeted countries, followed by China and Indonesia, while media and publishing remained the most affected industry. Mirai variants accounted for 46.5% of network-layer bytes, with new families such as Dysphoria and Evooo1Bot emerging to replace dismantled botnets.
Freshko: Open-Source Rust Tool Offers Local File and URL Scanning Without Data Upload
A developer has released Freshko, a compact 400x640 pixel desktop application built in Rust that performs quick local checks on files, folders, and URLs without sending data to external services. The tool uses YARA-X rules for file scanning, follows up to eight redirects while querying Cloudflare's filtering DNS, and scores processes for potential cryptocurrency miners based on names, arguments, and launch paths. It explicitly avoids acting as a full antivirus solution, instead providing transparent results that list any skipped items or incomplete checks. Freshko runs on macOS and Windows, keeps all scan results in memory only, and disables system proxies during URL checks to prevent DNS rebinding attacks. The project includes performance benchmarks on Apple Silicon and addresses common pitfalls such as high CPU usage false positives and incomplete disk scans. Unlike VirusTotal or Cloudflare URL Scanner, Freshko performs all file analysis locally and never makes scan reports public.
Yoba Campaign Uses Signed ChatGPT and Claude Binaries for DLL Sideloading and XMRig Deployment
Researchers at Check Point Research have uncovered the Yoba malware campaign that distributes fake desktop clients for ChatGPT and Claude through GitHub repositories. The attackers bundle legitimate signed executables from OpenAI and Anthropic with a malicious DLL that gets loaded via classic sideloading. Once executed, the loader establishes persistence using the Windows Task Scheduler and retrieves additional payloads through Telegram, DNS over HTTPS, and the Catbox file hosting service. The campaign ultimately deploys the XMRig cryptominer, which pauses mining activity when user interaction is detected to avoid detection. No compromise of OpenAI or Anthropic infrastructure was found; the attackers simply repurpose the companies' signed binaries and reputation. The operation primarily targets home users and small-to-medium businesses with Windows systems.