Threat reportMalwareTL-2026-3822
YuanKong Android RAT Hijacks Phones to Steal Banking PINs and Passwords
YuanKong Android RAT Hijacks Phones to Steal Banking PINs (TL-2026-3822) is a high-severity malware campaign, first published 2026-10-17. It has no confirmed attribution, affects Google Android, maps to 13 MITRE ATT&CK techniques (T1406, T1414, T1417), and is covered by 9 detection rules and 18 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-3822
- Threat ID
- TL-2026-3822
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, consumer
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in YuanKong Android RAT Hijacks Phones to Steal Banking PINs
Malware and tooling: RemoteControl, YuanKong, Socket.IO/Engine.IO over WebSocket (TLS)
How YuanKong Android RAT Hijacks Phones to Steal Banking PINs works
YuanKong is an Android remote-access Trojan delivered through two-stage dropper apps carrying XOR-encrypted payloads. It abuses the Accessibility API and Wireless Debugging (ADB) for keylogging, fake-keypad PIN theft and remote device control. Star Labs found 42 operator accounts across 110 droppers and 57 child payloads, which points to a malware-as-a-service model.
YuanKong is an Android remote-access Trojan (RAT) built for financial fraud and device hijacking. It was documented by Star Labs in October 2026 in the report "YuanKong RAT: The Android Remote Control Service That Stamps Its Operators' Names Into Every Build" and covered by Cyber Security News on 2026-10-16.
Delivery uses a two-stage model. The stage-1 dropper embeds a hidden payload protected only by weak XOR encryption (vault marker SVLT-XOR-v2) with the decryption key embedded alongside it. At runtime the dropper extracts and installs the stage-2 child app, which installs as package net.echorelay.app and identifies itself as YuanKong (application class com.remote.control.RemoteControlApp). One analysed Nova loader used package name com.system.loader.va363d031. Star Labs analysed 110 droppers and 57 distinct child payloads that share the same child-app signing certificate, and a separate signer for the Nova dropper family.
Credential theft relies on the Accessibility API. The malware reads accessibility events from input-field changes and inspects the accessibility tree for password fields. It also shows fake numeric keypads that capture the real digits while displaying masked dots, and it maps touch coordinates on genuine keypads to reconstruct entered PINs. Remote-control features include screen capture, remote taps and swipes, clipboard access, notification reading, file transfer and location collection. The malware abuses Accessibility to enable Wireless Debugging and complete ADB pairing, which gives it a non-root shell-level session. It then uses a local ADB shell to install a daemon that restarts the malware.
Persistence and resilience features include hiding the app icon, interdependent services, automatic restart, and offline queuing of collected data for later upload. Command and control uses Socket.IO/Engine.IO over WebSocket with typed JSON messages. TLS is the only transport protection, with no additional message-level encryption. Star Labs identified 42 distinct operator accounts embedded across the samples, which suggests shared malware-as-a-service infrastructure with multiple operators. Published infrastructure comprises three registered domains (apppanda.xyz, ktxapp.com, ktx123.net), the www hosts of the latter two, and one IP address (206.82.1.14). The article does not give in-the-wild victim counts, the specific banking apps targeted, or the initial distribution channel. ACTIVE status is based on the identified operator infrastructure. Severity is analyst-assigned because no CVE or CVSS applies. A BeaconBeagle lookup for 206.82.1.14 returned HTTP 404 (no record) at research time.
MITRE ATT&CK techniques used in TL-2026-3822
Defense Evasion
T1406 Obfuscated Files or Information; T1628.001 Suppress Application Icon
Collection
T1414 Clipboard Data; T1430 Location Tracking; T1513 Screen Capture; T1517 Access Notifications
Credential Access
T1417 Input Capture; T1417.001 Input Capture: Keylogging; T1417.002 Input Capture: GUI Input Capture
Discovery
T1420 File and Directory Discovery
Command and Control
T1437.001 Application Layer Protocol: Web Protocols
Execution
T1623.001 Command and Scripting Interpreter: Unix Shell
Exfiltration
Affected products and versions in YuanKong Android RAT Hijacks Phones to Steal Banking PINs
- Google — Android
Vulnerable versions: Android devices where the user grants Accessibility and Wireless Debugging access to a malicious app
Remediation for YuanKong Android RAT Hijacks Phones to Steal Banking PINs
Patches
- No CVE is involved; there is no vendor patch. Keep Android and Google Play Protect up to date
Immediate actions
- Block the domains apppanda.xyz, ktxapp.com, www.ktxapp.com, ktx123.net and www.ktx123.net and the IP 206.82.1.14 at DNS, proxy and firewall
- Search MDM/EMM inventories for packages net.echorelay.app and com.system.loader.va363d031 and for the application class com.remote.control.RemoteControlApp
- Search for apps signed with the child-app signer SHA-256 73cbe8e3730cacfdd208f22eab468bb5495a78c0eb2cb37eff5af0cafe321387 or the Nova dropper signer SHA-256 af92f7d616564dabffb0679a1a38fb24d6a6c4e4a90114c6eb0834c57dd456c9
- Isolate and factory-reset confirmed infected devices, then rotate banking and payment credentials and PINs entered on them
Workarounds
- Disable Wireless Debugging and developer options on end-user devices
- Revoke Accessibility permission from untrusted apps and uninstall them
- Install apps only from vetted app stores
Longer-term hardening
- Restrict sideloading and installs from unknown sources on managed devices
- Alert on apps that request Accessibility service access, and review which apps hold it
- Alert on Wireless Debugging or ADB being enabled on non-developer devices
- Deploy mobile threat defense that flags dropper behaviour such as embedded encrypted payloads and silent child-app installs
Timeline of YuanKong Android RAT Hijacks Phones to Steal Banking PINs
- Threadlinqs hunt identified the report and opened tracking as TL-2026-3822; BeaconBeagle returned no record (HTTP 404) for 206.82.1.14.
- IOCs published: domains apppanda.xyz, ktxapp.com and ktx123.net (plus www hosts), IP 206.82.1.14, two signer certificate SHA-256 hashes, and sample hashes for droppers and child apps.
- Capabilities documented: Accessibility-based keylogging and password-field inspection, fake numeric keypads and touch-coordinate PIN reconstruction, remote screen control, and Wireless Debugging/ADB abuse for a non-root shell session and daemon persistence.
- 42 distinct operator accounts reported as embedded across the samples, indicating shared malware-as-a-service infrastructure with multiple operators.
- Star Labs analysis reported as covering 110 droppers and 57 distinct child payloads sharing the same signing certificate.
- Reported publicly (Cyber Security News, summarising Star Labs research published October 2026): two-stage droppers hide a payload under weak XOR encryption (SVLT-XOR-v2) with the key embedded, and install the child app net.echorelay.app. The original Star Labs publication date is not stated in the source.
Sources cited for YuanKong Android RAT Hijacks Phones to Steal Banking PINs
- New YuanKong Android RAT Hijacks Phones to Steal Banking PINs and Passwords (research by Star Labs)
- MITRE ATT&CK Mobile: Input Capture (T1417)
- MITRE ATT&CK Mobile: Screen Capture (T1513)
- MITRE ATT&CK Mobile: Access Notifications (T1517)
- MITRE ATT&CK Mobile: Suppress Application Icon (T1628.001)
- MITRE ATT&CK Mobile: Application Layer Protocol - Web Protocols (T1437.001)
Detection coverage for TL-2026-3822
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3822 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.