YuanKong Android RAT Uses Accessibility Features to Steal Banking Credentials

Star Labs researchers identified a new Android remote-access Trojan named YuanKong that captures banking PINs and passwords by hijacking device controls. The malware leverages Android’s Accessibility features to observe user activity within financial applications, allowing operators to steal sensitive credentials without needing traditional SMS or contact list permissions.

The threat actors behind YuanKong can watch and control victim phones remotely, sending stolen data back to command-and-control servers. According to Cyber Security News, this approach exposes sensitive information even when users interact with legitimate applications. The malware remains active to provide continuous remote control, capturing screen content, reading notifications, and accessing the clipboard to exfiltrate data.

Technical Analysis and Infrastructure

Star Labs examined 110 dropper applications and 57 distinct child payloads, all signed with the same YuanKong certificate. The investigation revealed that different samples contained unique operator account details, suggesting the malware is offered as a shared service for multiple threat actors. The initial dropper app contains a hidden child application that it unpacks and installs on the victim’s device after execution.

The dropper stores its decryption key and initialization values in a configuration file alongside the encrypted payload. Researchers noted that the file uses a simple XOR process rather than strong encryption, allowing analysts to recover the child app without contacting the operator’s server. Once extracted, the child app identifies itself as YuanKong and connects to command-and-control infrastructure using Socket.IO and WebSocket protocols.

Communication between the malware and its servers relies on typed JSON messages protected by TLS. The analysis found no additional encryption layer for the data transmitted within that connection. Operators can send commands and receive collected information, including screen captures and files, through this channel. The malware does not request permissions for SMS, contacts, call logs, cameras, or microphones, focusing its risks on screen and Accessibility access.

Persistence and Debugging Abuse

YuanKong employs Android’s debugging features to deepen its control over infected devices. The malware uses Accessibility services to enable Wireless Debugging, read the pairing details displayed on the phone, and pair with the device’s local Android Debug Bridge service. This process grants the malware a shell-level session, which is distinct from root access but sufficient for malicious activities.

With shell-level access, YuanKong can grant specific permissions and run persistence scripts to ensure it remains active on the device. As Threat Times reported on October 16, 2026, GhostBat malware also abuses Android Accessibility Services to capture PINs from financial apps. YuanKong utilizes similar mechanisms to observe and control user interactions within banking and payment applications.

What should you do?

Security professionals should monitor for unauthorized Accessibility service activations and unexpected Wireless Debugging sessions on managed Android devices. Organizations should educate users about the risks of granting Accessibility permissions to unknown applications, as this can bypass standard security controls. Administrators should also review device logs for signs of remote shell access or unusual WebSocket connections that may indicate RAT activity.

What to do and how to stay safe

• Hardware-backed key storage prevents attackers from extracting credentials even if they gain physical access to the device.
• Mobile device management enforces consistent security policies across diverse operating systems and hardware configurations.
• Application sandboxing limits the damage a compromised app can cause by restricting its access to other data and system resources.

Mobile device security requires a layered approach combining hardware, software, and policy controls. Enable encryption, use strong passcodes, and keep your operating system updated to protect your data.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.