New YuanKong RAT Hijacks Android Phones to Steal Bank PINs and Passwords

A recently analyzed Android remote-access Trojan (RAT) called YuanKong can observe and control an infected phone, capture passwords and payment PINs, and exfiltrate the stolen data to remote operators.

Instead of depending on access to SMS messages or contact lists, YuanKong leverages Android’s Accessibility APIs and on-screen controls to monitor user activity inside applications, including banking and payment apps.

Researchers warn that this technique can expose sensitive information even while the victim is interacting with legitimate apps. The malware is also designed to remain active on the device and provide operators with remote control.

Its features include screen capture, remote taps and swipes, clipboard access, notification reading, file transfer, and location collection.

The analyzed sample did not request permissions for SMS, contacts, call logs, the camera, or the microphone, so its primary risks arise from what it can observe and manipulate through Accessibility access and direct screen interactions.

Security researchers at Star Labs identified and dissected the malware by inspecting its Android application packages and code. Their study covered 110 dropper samples and 57 distinct child payloads, all signed with the same YuanKong certificate. Individual samples contained differing operator account details, indicating a shared service that multiple operators can use.

New YuanKong Android RAT Hijacks Phones

In the Star Labs sample, the initial app acts as a dropper: it includes a hidden child application and installs that payload after unpacking it.

The dropper stores its decryption key and initialization value together with the encrypted data in a configuration file. The researchers found the payload uses a simple XOR-based routine rather than strong encryption, allowing the child app to be recovered from the dropper without needing to contact the operator’s server.

The extracted child app identifies itself as YuanKong and connects to command-and-control servers using Socket.IO and WebSocket transports.

Messages use typed JSON and rely on TLS for transport confidentiality; the analysis found no additional encryption wrapping the messages inside that TLS channel. The server can issue commands and receive collected artifacts such as screen captures and files.

YuanKong also abuses Android’s Wireless Debugging feature via Accessibility: it can enable Wireless Debugging, read the pairing code displayed on the device, and pair with the local Android Debug Bridge (ADB) service.

Pairing provides a shell-level session (not root) that the malware can use to grant permissions and execute a persistence script. Similar ADB misuse has been observed in RedHook’s ADB abuse and other Android malware families.

How it captures PINs and passwords

The RAT can read text from Accessibility events, including changes in input fields, and inspect the accessibility tree to locate password fields.

It supports a fake numeric keypad overlay: while the victim sees masked dots on-screen, the malware records taps and stores the actual digits in its capture buffer.

For some real numeric keypads, YuanKong can map the positions of digit buttons and infer entered numbers by tracking touch coordinates.

Payment PINs can also be captured using an overlay technique. An operator can supply a web page that is displayed over a targeted payment app; if the victim enters a PIN into that imitation screen, YuanKong logs the value and can forward it to the command server.

These tactics serve similar goals to other Android threats that use fake banking screens or Accessibility access, such as banking overlays reported in other families.

Operators can remotely simulate clicks and swipes, open apps, and lock the screen. YuanKong can hide its launcher icon, run services that restart one another, resist removal, and queue stolen records for later upload if the network connection drops.

The local ADB shell can be used to install a daemon that helps keep the malicious app running; Star Labs describes this as escalation to the Android shell user rather than gaining root privileges.

The researchers located 42 operator accounts across the samples they reviewed. Account identifiers and enrollment details embedded into the app and sent in device activity reports let analysts link specific builds to particular operator accounts without needing access to the control panel.

The analysis did not determine how victims were initially tricked into installing these apps or how many devices have been infected; those details remain unknown.

For defenders, the shared YuanKong signing certificate and the set of command-and-control hosts are more reliable family indicators than frequently changing package names and app branding.

Security teams should search for the certificate hashes, the listed domains and IP addresses, signs of suspicious Wireless Debugging activity, unfamiliar Accessibility services, and unexpected remote-control behavior.

The signing certificate is a strong detection signal, but teams should validate any findings in their own environment before taking remedial action.

Phone users should avoid installing APKs from links or unfamiliar sites, regularly review which apps have Accessibility access, and keep Wireless Debugging disabled unless explicitly required. If a device may be compromised, contact the bank using an official number and change banking credentials from a separate trusted device. Recent reporting on other Android RATs shows why unusual Accessibility or debugging requests warrant close attention.

Indicators of compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (for example, use of “[.]”) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI feeds with data from 16K SOCs.