A new Android remote-access Trojan dubbed YuanKong has emerged as a dangerous threat to mobile users. Rather than stealing data via SMS or contacts, YuanKong abuses Android’s built-in Accessibility features and screen control tools to spy on banking and payment apps directly. This allows the malware to capture sensitive information like passwords and PINs, even while users think they’re using legitimate applications.
How YuanKong Works
Discovered by security researchers at Star Labs, YuanKong operates through a two-stage mechanism. The first stage is a “dropper” app disguised to install a hidden child app once deployed. The dropper also stores a decryption key and initialization value in its configuration file, encrypted only using a simple XOR method—making it possible to extract the child app without communicating with the attacker’s servers. The child component establishes a connection with command-and-control (C2) servers over Socket.IO and WebSockets. Although those channels are run over TLS, the messages themselves aren’t doubly encrypted.
Once inside, the child app leverages several Android system tools to gain deeper access. Through the Accessibility interface, YuanKong can enable wireless debugging, grab ADB (Android Debug Bridge) pairing details shown on the device, and launch a shell-level session—not root permissions, but powerful enough to install daemons and persist across reboots. It also has modules to capture screenshots, monitor the clipboard, read notifications, transfer files, and log user location.
Techniques for Stealing PINs & Passwords
The RAT monitors input fields via Accessibility events and scans the screen’s accessibility tree to find password fields. It uses fake PIN keypads or overlays to trick victims. In some cases, legitimate numeric keypads are analyzed by tracking tap coordinates. For payment apps, YuanKong can display counterfeit interfaces resembling the app’s screen; when users enter their PINs here, the malware captures the data and sends it to its C2 server.
To avoid detection and removal, the malware can hide its icon, use services that mutually restart if one is killed, and queue stolen data for upload if connectivity is lost. The ADB shell session allows deployment of persistence scripts to help ensure it stays active—which together contribute to its resilience.
Evidence & Indicators
In the analyzed sample, researchers reviewed 110 dropper apps and 57 child payloads all signed with a common YuanKong certificate. Operator accounts vary, but use of the same signing certificate and command-and-control domains and hosts link the apps to a shared service offering access to multiple operators. While the method of infecting devices and how widespread infections are remain unclear, indicators like Certificate SHA-256 hashes, known C2 domains, IPs, and typical behaviors are now documented.
Suggested defense strategies include monitoring for unfamiliar apps with Accessibility access, keeping Wireless Debugging turned off unless needed, detecting strange remote-control behavior, and watching for known certificate signatures and C2 domains. If a phone is suspected of compromise, affected users should contact their bank via trusted channels and reset passwords using a clean device.
What this means: YuanKong is part of a rising wave of Android malware that sidesteps traditional safeguards by abusing system-level tools like Accessibility and ADB. As app permissions and sandboxing become more robust, attackers are turning to covert channels and overlays—making detection harder. Defenders and users alike will need to adapt: better monitoring, tighter access controls, and more awareness of seemingly small permission requests. Watch closely for reports showing how widespread this RAT is, and whether it evolves to gain root-level control—an escalation that could make its damage even more severe.
