YuanKong

YuanKong is an Android remote-access Trojan designed to monitor and control infected phones, steal credentials and payment PINs, and exfiltrate collected information. Analysis of 110 droppers and 57 distinct child payloads identified 42 operator accounts. The child payloads share a signing certificate and command-and-control infrastructure, while build-specific account identifiers associate individual deployments with operators. The Nova dropper unpacks an XOR-protected payload and installs the hidden YuanKong application. Initial infection lures, victim numbers, and attribution to a named threat actor have not been established.

YuanKong abuses Android Accessibility services to inspect on-screen content, capture input-field changes, and read password-designated fields, including within genuine applications. It captures payment PINs through imitation numeric keypads, operator-supplied HTML overlays, and mapping genuine keypad buttons to touch coordinates. Additional capabilities include screenshots, live screen streaming, accessibility-tree collection, clipboard synchronization, notification and OTP reading, file transfers, and location collection. Operators can remotely tap, swipe, enter text, launch applications, and lock the screen. Stolen records are stored locally and queued for transmission when connectivity returns. Command-and-control communication uses Socket.IO/Engine.IO over WebSocket with typed JSON messages and TLS transport protection.

YuanKong can manipulate Accessibility controls to enable Wireless Debugging, obtain pairing details, and pair with the device’s local Android Debug Bridge service. This provides Android shell privileges rather than root access, enabling permission grants, screen capture without a MediaProjection consent prompt, and installation of a persistence daemon. Other persistence and concealment mechanisms include device-administration functionality, mutually restarting foreground services, application-icon hiding, removal resistance, and black-screen overlays. The analyzed child does not implement direct SMS, contacts, call-log, camera, or microphone collection; its primary surveillance mechanisms rely on Accessibility and screen access.