Security Oct 2026

In many Iranian companies, Telegram is still the main tool for day-to-day coordination. Sales groups, sending files to clients and following up on orders often run through this messenger. At the same time, installing unofficial Telegram builds and APK files from random channels and websites is a well-established habit for many employees. A new report shows this habit has become a real entry point for attackers.

According to The Hacker News, citing findings by a researcher known as Ovi, uCreator is a rentable Android spyware kit. It hides its malicious code inside fully working copies of Telegram and WeChat. The user sees a normal app with all the familiar features and has no obvious reason to be suspicious. Because the kit is rented out, attackers don't need deep technical skills to use it.

For managers, the key point is how this spyware gets in. Per the same report, uCreator only reaches people who install one of these tampered copies from outside the official app stores. For WeChat, the other route is running the app inside the kit makers' own "container" app. The report also says the kit's Telegram component matches Baohuo, a backdoor previously identified by the security firm Doctor Web. That match suggests a mature, recurring threat rather than a one-off experiment.

You might assume two-step verification is enough, but this report suggests otherwise. According to The Hacker News, the spyware can steal Telegram two-step verification passwords as well. The logic is simple: when the app itself is compromised, everything the user types passes through the attacker's code. Two-step verification stops someone trying to get in from the outside, not code already sitting inside the user's own phone.

For a business, an account takeover means far more than a few leaked personal messages. The attacker gains access to work conversations, shared files, client lists and internal groups. They can even message clients or colleagues from a real employee's account and ask for payments or information. In Iran, filtering and the search for builds with built-in proxies or extra features make this risk broader than in many other countries. When personal and work use share the same phone, this entry point leads straight to company data.

The first step is a clear app installation policy. Telegram should only be installed from Google Play or the official telegram.org site, and modified builds and APKs from channels should be explicitly banned. Draw up a short list of approved work apps and walk your staff through it in a brief session. The second step is separating work phones: either issue dedicated devices for sensitive roles, or at least use Android's Work Profile with central management so work apps stay isolated from personal installs.

The third step is regularly reviewing active sessions. In Telegram, the Devices section in Settings shows every device connected to the account and lets you terminate unfamiliar sessions. But if the phone itself may be infected, ending sessions alone is not enough. In that case, remove the suspicious app, install the official version, change the two-step verification password from a clean device, and then terminate all other sessions.

Spyware like uCreator doesn't exploit a technical flaw in the operating system; it exploits a common habit. The good news is that closing this door depends more on policy and workplace culture than on heavy spending. We suggest listing, this week, the employees who run core company work through Telegram and starting these three steps with them. If you need help drafting the policy or setting up central device management, a security advisor can shorten the path considerably.

Start a project