A newly reported Android spyware kit known as uCreator has been linked to the takeover of Telegram and WeChat accounts through modified versions of the apps. According to reporting cited by The Hacker News and research attributed to Ovi, the malware is delivered through tampered app copies distributed outside official app stores, or through a dedicated container app used to run WeChat.

For European businesses, the story is relevant less because of the specific malware name and more because it highlights a recurring mobile security risk: staff using unofficial mobile apps for messaging, support, sales or partner communication can expose business conversations and account access.

What happened

The reported spyware is described as a rentable Android malware kit. Researchers say it hides malicious code inside working versions of Telegram and WeChat, allowing the apps to appear functional while capturing sensitive information in the background.

Based on the source report, the malware does not spread through the official app stores. Instead, the risk affects users who manually install altered app packages from other sources, or who run WeChat inside the malware operator's own container app. The article also states that the Telegram component can steal two-factor authentication information, creating a path to account compromise.

At the time of the report, the findings appear to be based on researcher analysis referenced by The Hacker News. Businesses should treat the operational lessons as important even if they are not users of the specific affected apps.

Why it matters for European businesses

Many SMEs and international teams use consumer messaging apps alongside formal workplace tools. In some sectors, Telegram and WeChat are used for distributor relationships, customer communication, local market coordination and supplier conversations. If one of these accounts is compromised, the impact can go beyond an individual employee device.

• Account takeover risk: Attackers may gain access to chats, contacts and authentication flows.
• Business impersonation: A hijacked messaging account can be used to contact customers, partners or colleagues while appearing legitimate.
• Data exposure: Commercial discussions, pricing, documents, payment details or personal data shared in chats may be exposed.
• Mobile security gap: Companies often protect email and laptops more rigorously than employee smartphones.

The report is also a reminder that two-factor authentication is not a complete safeguard if the device or app receiving the authentication data is already compromised.

Who may be affected

• SMEs whose staff use Android phones for business messaging
• E-commerce companies using chat apps for customer support, sourcing or marketplace coordination
• Sales and partnership teams communicating with overseas suppliers or resellers through WeChat or Telegram
• IT and security teams responsible for bring-your-own-device or mobile device management policies
• Regulated businesses where messaging accounts may involve personal data, client information or sensitive commercial records

The risk is higher where employees sideload apps, use unmanaged Android devices, or mix personal and business communications on the same phone.

What companies should consider

• Restrict unofficial app installation: Remind staff to install business-related apps only from official app stores or approved enterprise channels.
• Review mobile policies: If employees use personal Android devices for work, ensure mobile security rules cover sideloading, app permissions and update requirements.
• Separate critical workflows from consumer chat apps: Avoid relying on messaging apps alone for approvals, payment instructions or account recovery.
• Strengthen monitoring for impersonation: Warn teams and customers that a legitimate messaging account can still be misused after compromise.
• Use device management where appropriate: For higher-risk teams, mobile device management or app allow-listing can reduce exposure to tampered apps.
• Check authentication dependencies: Review whether important services depend on SMS or messaging-based codes delivered to mobile devices that may be at risk.

For European companies, the practical takeaway is clear: mobile messaging apps used in business operations should be treated as part of the security perimeter. Even when malware is not distributed through official stores, sideloaded or wrapped apps can create a direct route into employee accounts, business conversations and trusted communication channels.