Android Malware Exposes Its Own Operators While Hijacking Phones and Stealing Sensitive Data
Android RAT YuanKong leaks operator account IDs while abusing Accessibility and Wireless Debugging to control phones.
STAR Labs analyzed 110 YuanKong Android droppers and recovered 57 child payloads, 42 operator accounts, and 44 rotating brands tied by one signing certificate and shared command-and-control infrastructure. A simple two-key XOR and a plaintext key and IV in assets/vault-config.json let analysts extract the payload without executing it. The RAT lacks SMS, contacts, camera, and microphone permissions; it abuses Accessibility services to read interface text, infer PINs, stream the screen, and overlay payment apps. After enabling Wireless Debugging it pairs with the device’s own ADB for shell access, using Socket.IO WebSockets to apppanda.xyz, ktxapp.com, ktx123.net, and 206.82.1.14. The number of infected devices was not established.