# YuanKong Android RAT Hijacks Phones to Steal Banking PINs and Passwords

> YuanKong is an Android remote-access Trojan delivered through two-stage dropper apps carrying XOR-encrypted payloads. It abuses the Accessibility API and Wireless Debugging (ADB) for keylogging, fake-keypad PIN theft and remote device control. Star Labs found 42 operator accounts across 110 droppers and 57 child payloads, which points to a malware-as-a-service model.

- **Published:** 2026-10-17T16:40:42Z
- **Last reviewed:** 2026-10-17T16:40:42Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3822
- **ID:** TL-2026-3822
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

YuanKong is an Android remote-access Trojan (RAT) built for financial fraud and device hijacking. It was documented by Star Labs in October 2026 in the report "YuanKong RAT: The Android Remote Control Service That Stamps Its Operators' Names Into Every Build" and covered by Cyber Security News on 2026-10-16.

Delivery uses a two-stage model. The stage-1 dropper embeds a hidden payload protected only by weak XOR encryption (vault marker SVLT-XOR-v2) with the decryption key embedded alongside it. At runtime the dropper extracts and installs the stage-2 child app, which installs as package net.echorelay.app and identifies itself as YuanKong (application class com.remote.control.RemoteControlApp). One analysed Nova loader used package name com.system.loader.va363d031. Star Labs analysed 110 droppers and 57 distinct child payloads that share the same child-app signing certificate, and a separate signer for the Nova dropper family.

Credential theft relies on the Accessibility API. The malware reads accessibility events from input-field changes and inspects the accessibility tree for password fields. It also shows fake numeric keypads that capture the real digits while displaying masked dots, and it maps touch coordinates on genuine keypads to reconstruct entered PINs. Remote-control features include screen capture, remote taps and swipes, clipboard access, notification reading, file transfer and location collection. The malware abuses Accessibility to enable Wireless Debugging and complete ADB pairing, which gives it a non-root shell-level session. It then uses a local ADB shell to install a daemon that restarts the malware.

Persistence and resilience features include hiding the app icon, interdependent services, automatic restart, and offline queuing of collected data for later upload. Command and control uses Socket.IO/Engine.IO over WebSocket with typed JSON messages. TLS is the only transport protection, with no additional message-level encryption. Star Labs identified 42 distinct operator accounts embedded across the samples, which suggests shared malware-as-a-service infrastructure with multiple operators. Published infrastructure comprises three registered domains (apppanda.xyz, ktxapp.com, ktx123.net), the www hosts of the latter two, and one IP address (206.82.1.14). The article does not give in-the-wild victim counts, the specific banking apps targeted, or the initial distribution channel. ACTIVE status is based on the identified operator infrastructure. Severity is analyst-assigned because no CVE or CVSS applies. A BeaconBeagle lookup for 206.82.1.14 returned HTTP 404 (no record) at research time.

## MITRE ATT&CK

- T1417 Input Capture
- T1417.001 Input Capture: Keylogging
- T1417.002 Input Capture: GUI Input Capture
- T1513 Screen Capture
- T1517 Access Notifications
- T1414 Clipboard Data
- T1430 Location Tracking
- T1628.001 Suppress Application Icon
- T1406 Obfuscated Files or Information
- T1623.001 Command and Scripting Interpreter: Unix Shell
- T1420 File and Directory Discovery
- T1437.001 Application Layer Protocol: Web Protocols
- T1646 Exfiltration Over C2 Channel

## Sources

- [New YuanKong Android RAT Hijacks Phones to Steal Banking PINs and Passwords (research by Star Labs)](https://cybersecuritynews.com/new-yuankong-android-rat/)
- [MITRE ATT&CK Mobile: Input Capture (T1417)](https://attack.mitre.org/techniques/T1417/)
- [MITRE ATT&CK Mobile: Screen Capture (T1513)](https://attack.mitre.org/techniques/T1513/)
- [MITRE ATT&CK Mobile: Access Notifications (T1517)](https://attack.mitre.org/techniques/T1517/)
- [MITRE ATT&CK Mobile: Suppress Application Icon (T1628.001)](https://attack.mitre.org/techniques/T1628/001/)
- [MITRE ATT&CK Mobile: Application Layer Protocol - Web Protocols (T1437.001)](https://attack.mitre.org/techniques/T1437/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3822