New YuanKong Android RAT Hijacks Phones to Steal Banking PINs and Passwords

A newly analyzed Android remote-access Trojan called YuanKong can watch and control a victim’s phone, capture passwords and payment PINs, and send stolen information to operators.

Rather than relying on access to text messages or contact lists, it uses Android’s Accessibility features and screen controls to observe what people do inside apps, including banking and payment apps.

Researchers warn that this approach can expose sensitive information even when the user is interacting with a genuine app. The malware is also built to stay active and give operators control from afar.

Its capabilities include screen capture, remote taps and swipes, clipboard access, notification reading, file transfers and location collection.

The examined sample did not request permissions for SMS, contacts, call logs, a camera or a microphone, so its risks come mainly from what it can read and do through the screen and Accessibility access.

Researchers from Star Labs identified and analyzed the malware by examining its Android app files and code. Their investigation covered 110 droppers and 57 distinct child payloads, all signed by the same YuanKong certificate. The samples carried different operator account details, pointing to a shared service that can be used by multiple operators.

New YuanKong Android RAT Hijacks Phones

In the sample examined by Star Labs, the first app acts as a dropper: it contains a hidden child app and installs it after unpacking the payload.

The dropper stores its decryption key and initialization value in a configuration file alongside the encrypted data. The researchers found that the file uses a simple XOR process rather than a strong encryption method, making the child app recoverable from the dropper without contacting the operator’s server.

The extracted child app identifies itself as YuanKong and connects to command-and-control servers over Socket.IO and WebSocket.

Its messages use typed JSON, while transport confidentiality relies on TLS; the analysis found no extra encryption layer for the messages inside that connection. The server can send commands and receive collected data, including screen captures and files.

The use of Android’s own debugging feature adds another layer of concern. YuanKong can use Accessibility to enable Wireless Debugging, read the pairing details shown on the phone, and pair with the device’s local Android Debug Bridge service.

This gives it a shell-level session, not root access, which it can use to grant permissions and run a persistence script. Similar misuse of Wireless Debugging has been reported in RedHook’s ADB abuse and other Android malware cases.

How it captures PINs and passwords

YuanKong can read text from Accessibility events, including changes in input fields, and inspect the screen’s accessibility tree for password fields.

It also supports a fake numeric keypad overlay: taps enter the real digits into the malware’s capture buffer while the screen can display masked dots.

For some genuine keypads, the malware can map the positions of digit buttons and use touch coordinates to work out which numbers the victim entered.

Payment PIN theft can also use an overlay. An operator can supply a web page and have it displayed over a selected payment app. If the victim enters a PIN into that imitation screen, YuanKong records the value and can send it to the control server.

These methods are similar in broad purpose—but not necessarily in technical design—to other Android threats that use fake banking screens or Accessibility access, such as RemControl’s banking overlays.

Operators can remotely click, swipe, open apps and lock the screen. YuanKong can also hide its icon, use services that restart one another, resist removal and queue stolen records for later upload if the connection drops.

Its local ADB shell can install a daemon that helps keep the app running. The analysis describes this as escalation to Android’s shell user, not a root exploit.

The researchers traced 42 operator accounts across the samples they reviewed. Account identifiers and enrollment details were compiled into the app and sent in device activity reports, allowing analysts to link builds with particular accounts without accessing the control panel.

The sample analysis does not establish how victims were first lured into installing the apps or how many phones were affected, so those details remain unknown.

For defenders, the shared YuanKong signing certificate and command-and-control host set are stronger family clues than the changing package names and app branding.

Security teams can search for the certificate, the listed domains and IP address, suspicious Wireless Debugging activity, unfamiliar Accessibility services and unexpected remote-control behavior.

The certificate is a useful detection signal, but teams should confirm findings against their own environment before taking action.

Phone users should avoid installing APKs from links or unfamiliar sites, review which apps have Accessibility access, and leave Wireless Debugging off when it is not needed.

If a device may be infected, contact the bank using an official number and change banking passwords from a separate trusted device. Recent reporting on RatHat’s Android control also shows why unusual Accessibility and debugging requests deserve close attention.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.