New YuanKong Android RAT Hijacks Phones, Steals Banking Credentials

Key Takeaways

• A new Android Remote Access Trojan (RAT), dubbed YuanKong, has been discovered, capable of comprehensive phone hijacking and credential theft.
• YuanKong leverages Android’s Accessibility features and Wireless Debugging to monitor user activity, capture banking PINs and passwords, and maintain persistent control.
• Unlike many Android malware strains, YuanKong does not primarily rely on SMS or contact list access, instead focusing on screen-based interaction and data capture within legitimate apps.
• Researchers identified 110 droppers and 57 distinct payloads, all signed by a common YuanKong certificate, indicating a service-based malware model used by multiple operators.
• Users are advised to exercise extreme caution with app installations, limit Accessibility permissions, and disable Wireless Debugging when not in active use.

A sophisticated new Android Remote Access Trojan (RAT) named YuanKong has been uncovered, demonstrating advanced capabilities to remotely control compromised devices, monitor user interactions, and steal sensitive financial information, including banking passwords and payment PINs. This malware distinguishes itself by exploiting Android’s built-in Accessibility features and screen control mechanisms, rather than conventional methods like SMS or contact list access.

The threat posed by YuanKong is particularly severe because it can extract confidential data even when users are interacting with authentic banking and payment applications. Its design enables persistent remote control by attackers, facilitating a wide array of malicious activities.

YuanKong’s Operational Capabilities

The malware’s extensive feature set includes the ability to capture screenshots, simulate remote taps and swipes, access the device’s clipboard, read notifications, initiate file transfers, and collect location data. Importantly, the analyzed samples of YuanKong did not request permissions typically associated with high-risk malware, such as access to SMS messages, contacts, call logs, the camera, or microphone. This suggests that its primary vectors for compromise and data exfiltration are its screen observation and Accessibility access.

Researchers from Star Labs identified and meticulously analyzed YuanKong by dissecting its Android application files and underlying code. Their investigation encompassed 110 droppers and 57 unique child payloads, all bearing the same YuanKong digital certificate. The presence of varying operator account details within these samples points to a shared malware-as-a-service model, where multiple threat actors can utilize the YuanKong infrastructure.

Infection Vector and Persistence Mechanisms

The initial infection typically occurs via a dropper application, which harbors a concealed child application. This child app is then installed after the dropper unpacks its payload. Star Labs’ analysis revealed that the dropper stores its decryption key and initialization vector within a configuration file alongside the encrypted data. The use of a simple XOR process for encryption, rather than a more robust cryptographic method, allows for the recovery of the child app from the dropper without requiring communication with the operator’s command-and-control (C2) server.

Once installed, the extracted child app, identifying itself as YuanKong, establishes communication with C2 servers using Socket.IO and WebSocket protocols. While TLS secures the transport layer, the researchers found no additional encryption for messages exchanged within this connection. This C2 channel enables the server to issue commands to the compromised device and receive exfiltrated data, including screenshots and files.

A concerning aspect of YuanKong’s design is its abuse of Android’s Wireless Debugging feature. By leveraging Accessibility permissions, YuanKong can activate Wireless Debugging, read the pairing details displayed on the device, and then establish a connection with the local Android Debug Bridge (ADB) service. This grants the malware a shell-level session – though not root access – which it exploits to grant itself further permissions and deploy a persistence script. This technique of misusing Wireless Debugging has been observed in other Android malware, such as RedHook’s ADB abuse.

Stealing PINs and Passwords

YuanKong employs several cunning methods to capture sensitive credentials. It can read text from Accessibility events, including changes within input fields, and specifically target password fields by inspecting the screen’s accessibility tree. The malware also features a deceptive numeric keypad overlay. When a victim interacts with this fake keypad, their taps are recorded by YuanKong, while the screen misleadingly displays masked dots. For certain genuine on-screen keypads, the malware can even map the positions of digit buttons, inferring the entered numbers based on touch coordinates.

Furthermore, YuanKong facilitates payment PIN theft through overlays. An attacker can remotely inject a webpage to appear over a legitimate payment application. If the victim enters their PIN into this fraudulent screen, YuanKong captures the input and relays it to the C2 server. These tactics, while not necessarily identical in their technical implementation, share a common objective with other Android threats like RemControl, which also utilizes fake banking screens and Accessibility access to defraud users.

Beyond credential theft, operators can remotely interact with the compromised device by performing clicks, swipes, opening applications, and locking the screen. YuanKong is designed for stealth and resilience; it can hide its icon, utilize mutually restarting services to evade termination, resist removal attempts, and queue stolen data for upload if its C2 connection is temporarily lost. The local ADB shell session obtained by the malware can also install a daemon, further reinforcing the application’s persistence. This is described as an escalation to the Android shell user, not a root exploit.

The Star Labs investigation successfully identified 42 distinct operator accounts across the analyzed samples. Account identifiers and enrollment information embedded within the app and transmitted in device activity reports allowed analysts to link specific malware builds to individual operator accounts, even without direct access to the C2 control panel. However, the exact methods used to initially trick victims into installing these malicious applications, and the total number of compromised devices, remain unknown from the current analysis.

For cybersecurity defenders, the consistent YuanKong signing certificate and the fixed set of C2 domains provide robust indicators for detection, despite variations in package names and app branding.

What You Should Do

• Avoid Unknown APKs: Refrain from installing Android Package Kits (APKs) downloaded from untrusted sources, suspicious links, or unofficial app stores. Always prioritize downloading apps from the Google Play Store.
• Review Accessibility Permissions: Regularly check which applications have been granted Accessibility service permissions on your device. Only grant this access to trusted applications that genuinely require it for their core functionality. Be wary of any app requesting Accessibility permissions without a clear, legitimate reason.
• Disable Wireless Debugging: Keep Wireless Debugging (ADB over Wi-Fi) disabled in Developer Options unless it is absolutely necessary for development purposes. Enable it only when needed and disable it immediately afterward.
• Monitor for Suspicious Activity: Be vigilant for unusual app behavior, unexpected remote control actions, or unfamiliar Accessibility services running on your device.
• If Compromised: If you suspect your device is infected, immediately contact your bank or financial institutions using official contact numbers (not numbers found on the potentially compromised device). Change all banking and critical account passwords from a separate, trusted device. Consider performing a factory reset on the infected phone after backing up essential data.
• Stay Informed: Keep abreast of the latest Android malware threats, such as recent reports on RatHat’s Android control, which underscore the importance of scrutinizing unusual Accessibility and debugging requests.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.