YuanKong Android RAT Steals Banking PINs and Abuses Wireless Debugging

STAR Labs identified YuanKong, an Android remote-access Trojan that abuses Accessibility services, overlays, screen streaming, and touch-coordinate mapping to steal passwords and payment PINs, including during interactions with genuine banking apps. Researchers examined 110 droppers and 57 distinct child payloads linked to 42 operator accounts and 44 rotating build brands, suggesting a shared service used by multiple operators. Hardcoded account identifiers associate builds with operator accounts, while all analyzed child payloads share one signing certificate and a common command-and-control host set. The initial installation lure and number of affected phones remain unknown.

YuanKong supports remote device control, data collection, and persistence, and can manipulate Wireless Debugging to pair locally and obtain ADB shell privileges—not root access—for permission grants and persistence. Its command-and-control traffic uses TLS-protected Socket.IO and WebSocket connections. Defenders should prioritize the published shared signing certificate, command-and-control infrastructure, and sample hashes over rotating package names, and investigate unfamiliar Accessibility services and unexpected Wireless Debugging activity. STAR Labs explicitly excluded internal package-name seed strings from actionable indicators.