The toolkit’s Telegram component shares several technical characteristics with Baohuo, an Android backdoor documented by Doctor Web in October 2025. That investigation estimated that more than 58,000 devices had been infected. Both analyses identified the same code namespace, command-and-control server and command names.
However, researchers have not established whether the operators behind the two investigations are the same.
The malicious applications can execute code under the identity and permissions of the original apps, giving the spyware access to their data and internal functions. Target-specific modules are downloaded after installation, making the initial application package less revealing during security analysis. Ovi identified code supporting around 20 applications, including messaging platforms and mobile financial services, but published detailed technical findings for Telegram and WeChat.
For Telegram, the spyware can query the application’s message database to extract conversation histories. It also intercepts the login process to capture the user’s 2FA password before the application hashes it. With access to this information, an attacker could reset existing sessions, change the account’s linked phone number or delete the account. Additional functions can conceal an intruder’s session and interfere with the owner’s ability to recover access.
The WeChat module uses virtualization to run the legitimate application inside the toolkit’s own container. It can extract account identity information, package application data into an archive and upload it, while a bundled script helps reproduce the account.
Ovi and fellow researcher Jurre also uncovered backend source code on an exposed GitLab server. The code describes a cloud-based control platform rented by merchants and resellers, with commands assigned to individual customers.
Its capabilities include capturing login authorizations, collecting contact and profile information, adding friends in bulk and backing up accounts. Scheduling controls establish operating windows and randomized activity limits intended to make the behavior appear more natural and avoid platform security checks.
The product is known to its developers as YingGai, and records of the product line date to September 2021. Ovi linked elements of the operation to three companies in China’s Hunan province, although he cautioned that common ownership has not been proven. Some developers appeared to be making changes as recently as October 2026.
Testing on a Pixel 10 Pro running Android 17 showed that the toolkit’s hooking engine could not locate an internal function it relied on. However, another tool could still intercept application functions, meaning the result does not demonstrate that Android 17 prevents the attack.
Potential infection indicators include a file named TgJarPine.dex in some modified Telegram applications and original APK files retained by the LSPatch tool.
Several associated command and download domains were no longer resolving on October 23, 2026, although the version-upload domain still pointed to an active IP address.
Ovi stressed that his findings describe the toolkit’s technical capabilities rather than establish how many people have been affected. The research highlights the risks of installing modified messaging apps from untrusted sources, particularly when they can expose credentials and enable account takeover.
