YuanKong Android RAT Exploits Accessibility to Steal Banking Credentials
A new Android remote-access Trojan, YuanKong, leverages system Accessibility features and screen controls to steal banking PINs and passwords by observing user interactions, bypassing traditional security measures.
A sophisticated new Android remote-access Trojan (RAT) dubbed YuanKong has emerged, capable of hijacking user devices to steal sensitive banking credentials, including PINs and passwords. Unlike many other mobile threats that rely on intercepting SMS messages or accessing contact lists, YuanKong employs a more insidious method: it exploits Android's built-in Accessibility features and screen controls. This allows the malware to observe and record user interactions directly within applications, including highly sensitive banking and payment apps, thereby exposing critical information even when users believe they are interacting with legitimate services.
The YuanKong RAT's capabilities extend beyond passive observation. It can capture screenshots, perform remote taps and swipes on the screen, access clipboard data, read notifications, transfer files, and collect location information. Notably, the analyzed samples did not request permissions for sensitive data like SMS, contacts, call logs, camera, or microphone, indicating its primary attack vector is through screen and Accessibility access. Researchers from Star Labs identified and analyzed the malware, uncovering a shared service used by multiple operators, evidenced by 110 droppers and 57 distinct child payloads all signed with the same YuanKong certificate.
Technical analysis revealed that the malware's dropper component unpacks and installs a hidden child app. The decryption key and initialization value for the payload are stored in a configuration file, which uses a simple XOR process for decryption, making the child app recoverable without direct communication with a command-and-control (C2) server. Once unpacked, the YuanKong child app connects to C2 servers using Socket.IO and WebSocket protocols over TLS for transport confidentiality. While the messages themselves are typed JSON, there is no additional encryption layer within the established TLS connection, allowing operators to send commands and receive stolen data, including screen captures and files.
A particularly concerning feature of YuanKong is its ability to enable Wireless Debugging through Accessibility services. Once enabled, it can read the pairing details displayed on the phone and establish a connection with the device's local Android Debug Bridge (ADB) service. This grants the malware shell-level access, which it can then use to escalate privileges and install a persistence script, ensuring its continued operation on the compromised device. This technique of misusing Wireless Debugging for persistence and privilege escalation has been observed in other Android malware families.
YuanKong's methods for capturing PINs and passwords are multifaceted. It can read text from Accessibility events, including changes in input fields, and inspect the screen's accessibility tree to identify password fields. For numeric PINs, it can present a fake numeric keypad overlay. Taps on this overlay are recorded by the malware, while the screen displays masked dots to the user. In some cases, it can even map the positions of digit buttons on genuine keypads to infer the numbers entered by the victim. For payment apps, YuanKong can display a fake web page overlay that mimics a legitimate payment interface, capturing any PIN entered by the user.
Operators have extensive remote control over infected devices. They can initiate clicks, swipes, open applications, and lock the screen. The malware is designed for stealth and persistence, with features like icon hiding, self-restarting services, resistance to removal, and the ability to queue stolen records for later upload if network connectivity is interrupted. The local ADB shell can install a daemon to maintain the app's running state, effectively escalating its privileges to the Android shell user without requiring root access.
While the exact distribution methods and the total number of affected devices remain unknown, the analysis identified 42 distinct operator accounts across the examined samples. Security teams can detect YuanKong by searching for its shared signing certificate, known C2 domains and IP addresses, suspicious Wireless Debugging activity, unfamiliar Accessibility services, and unusual remote-control behaviors. Users are advised to avoid installing APKs from untrusted sources, regularly review app permissions, disable Wireless Debugging when not in use, and contact their banks from a trusted device if they suspect an infection.