YuanKong is an Android remote-control trojan analyzed by STAR Labs (October 2026). It is delivered through 'Nova' droppers (example loader package com.system.loader.va363d031) signed with a throwaway certificate (CN=Nova Build 20260703113341, OU=APK Factory, O=Nova, L=Singapore, C=SG). The dropper carries the child APK in an encrypted vault whose parameters are stored in plaintext in assets/vault-config.json. The 'SVLT-XOR-v2' routine is a two-key XOR (plaintext[i] = ciphertext[i] ^ key[i % keylen] ^ iv[i % ivlen]) with the key and IV in the same file, so the child APK (payload/child.apk inside a decrypted ZIP) can be recovered statically without running the sample. Across 110 droppers STAR Labs recovered 57 distinct child payloads, all signed with one shared certificate (CN=Remote Control, OU=Dev, O=YuanKong, L=Beijing, ST=Beijing, C=CN; SHA-256 73cbe8e3730cacfdd208f22eab468bb5495a78c0eb2cb37eff5af0cafe321387) and presenting under 44 rotating brand names.

The child (application class com.remote.control.RemoteControlApp) is a multi-tenant remote-control service. Each build hardcodes an operator account ID, account name and six-digit enrollment code as string constants in its configuration class; these values are included in C2 telemetry whenever the foreground app changes. That exposed 42 distinct operator accounts (for example handles lichunfeng7, xx7876 and laiqian2-001). C2 traffic is Socket.IO/Engine.IO over WebSocket (okhttp, wss) carrying typed JSON ControlMessage objects (AUTH, HEARTBEAT, RELIABLE_DATA_BATCH, RELIABLE_DATA_ACK) with no application-layer encryption beyond TLS. The shared relay set is apppanda.xyz, ktxapp.com and ktx123.net (plus www aliases for the latter two), and a hardcoded IP, 206.82.1.14, to which the domains resolved on 2026-10-15.

Capabilities: Accessibility-based UI inspection, password-field detection and keystroke capture (TYPE_VIEW_TEXT_CHANGED); gesture injection (click, long click, swipe, key input, back/home/recents); full and thumbnail screen capture, live screen streaming and a black-screen overlay; overlay keypads and HTML overlays that capture PINs and payment PINs (touch coordinates are mapped to keypad positions to infer PIN entry); clipboard and notification/OTP monitoring; location retrieval; file list/download/upload/delete/rename; app launching and lock-screen control. Data is stored locally in a Room database (PaymentPinRecord, KeyInputRecord, TouchRecord, AppUsageRecord, EventLogRecord) and queued as RELIABLE_DATA_BATCH when the socket is down. The sample declares no SMS, contacts, call-log, camera or microphone permissions and relies on UI control instead.

Privilege escalation does not use a software vulnerability. After obtaining Accessibility access the app turns on Wireless Debugging (Settings.Global adb_wifi_enabled=1, kept enabled by a GuardianService), parses the system pairing dialog through the accessibility node tree to extract the six-digit pairing code and port, and uses the embedded libadb-android library to complete a SPAKE2 pairing with the local adbd (127.0.0.1:5555, runtime-derived AES-128-GCM session key). Over the resulting shell channel (uid 2000, not root) it runs pm grant for WRITE_SECURE_SETTINGS, DUMP and PACKAGE_USAGE_STATS, whitelists itself from doze, and writes /data/local/tmp/remote_control_daemon.sh, a loop that restarts ConnectionService and sets oom_adj -17 / oom_score_adj -1000. Panel commands include LOCAL_ADB_ACTIVATE, LOCAL_ADB_PREPARE and LOCAL_ADB_CAPTURE; ADB screenrecord is used for H.264 streaming.

Persistence and evasion: a device-admin receiver, mutually rebinding foreground services (WatchdogService, KeepAliveMeshService, StealthKeepAliveService, AccountKeepAliveService), HIDE_APP_ICON, opportunistic su escalation on rooted devices, remote uninstall (REQUEST_SELF_UNINSTALL), and a stable device fingerprint persisted in credential-encrypted and direct-boot storage. STAR Labs notes that package names in the configuration (for example com.netflixgratis.app, io.litetube.app) are seed material for device-identity generation, not C2 indicators or confirmed targets, so defenders should not block on those names. STAR Labs compares YuanKong with RatHat (Zimperium, September 2026): both combine Accessibility abuse with local ADB pairing, but RatHat has a separate architecture (raw touch capture via getevent) and there is no evidence of a shared operator or codebase. No CVE is associated; severity is analyst-assigned from the reported capabilities. Actor attribution is not established: the certificate subject and operator handles suggest Chinese-language operators, but these are self-asserted strings.