Search — “TgJarPine.dex”

Researcher Ovi analyzed uCreator (YingGai), a rentable Android spyware kit embedded in tampered Telegram/Telegram X copies and run via the 'Onion Box' container app, distributed by sideloading and social engineering. It hooks Telegram's 2FA step to capture the cleartext password, hides attacker sessions, runs arbitrary queries against the message store, and clones WeChat accounts by zipping and uploading app data. Its Telegram component matches Doctor Web's Baohuo backdoor (58,000+ infected devices reported in 2025); Ovi frames his report as capability analysis, not a victim-impact count. Hunt for TgJarPine.dex in app assets, LSPatch artifacts at cache/lspatch/origin/*.apk, and listed C2/Redis infrastructure in mobile/DNS telemetry.