Android Malware Exposes Its Own Operators While Hijacking Phones and Stealing Sensitive Data
Android RAT YuanKong leaks operator account IDs while abusing Accessibility and Wireless Debugging to control phones.
58
Organization
STAR Labs
- Mentions · 7d0
- Mentions · 30d2
- All mentions9
- First seenSep 11, 2026
- Last mentioned25d ago
Timeline
9 articles · newest firstNew YuanKong Android RAT Hijacks Phones to Steal Banking PINs and Passwords
Star Labs analyzed YuanKong, an Android RAT using Accessibility and overlays to steal banking PINs and passwords.
66
How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail
Researcher details CVE-2025-39964, an AF_ALG race that gave unprivileged Linux users root and a $113,337 kernelCTF prize.
64
14-Year-Old Linux Kernel Flaw Lets Local Users Gain Root Access and Escape Containers
Linux kernel bug CVE-2025-39964 gives local users root and can escape Docker; CISA reports exploitation.
81
14-Year-Old Linux Kernel Vulnerability Enables Root Access and Docker Escape
Linux kernel flaw CVE-2025-39964 enables local root and Docker escape and is listed in CISA's KEV catalog.
84
Chrome Update Fixes 108 Vulnerabilities Including Critical GPU, WebGL and ANGLE Flaws
Chrome 154 patches 108 vulnerabilities, including critical memory-safety flaws in ANGLE, GPU, and WebGL that could enable code execution.
60
WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)
WordPress 7.1.2 fixes a critical unauthenticated path traversal flaw (CVE-2026-87902) that could allow remote code execution.
80
CISA alerts of active exploitation of three Linux kernel flaws
CISA says three Linux kernel flaws, one critical, are actively exploited and due for federal fixes today.
88
China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor
China-linked UNC3569 exploited a Sogou Input Method flaw to deploy GRAYRABBIT backdoor on Windows machines across East and Southeast Asia.
74
Related CVEs
by mentions- CVE-2025-399642%5.5Race Condition in Linux Kernel Crypto Socket (af_alg_sendmsg)
- CVE-2025-396823%9.8Improper Condition Check in Linux Kernel kTLS Receive Path Enables Local Info Leak/DoS
- CVE-2026-53266<1%8.8Out-of-Bounds Write in Linux Kernel ebtables SNAT ARP Rewrite (netfilter bridge)
- Heap buffer overflow in Chrome for Android ANGLE enables RCE
- Critical heap buffer overflow in Chrome ANGLE on Android
- CVE-2026-95350<1%9.6Heap buffer overflow in Google Chrome ANGLE on Android
- Out-of-bounds write in Chrome Android WebGL enables sandbox escape
- CVE-2026-95357<1%9.6GPU out-of-bounds write in Chrome for Android
- Use-after-free in Google Chrome Fullscreen enables sandbox escape
- GPU out-of-bounds write sandbox escape in Chrome on Android
Appears with
- Googleorganization · 6
- Googlevendor · 5
- Linux kernelproduct · 4
- Dockerproduct · 3
- CISAorganization · 3
- WordPressvendor · 2
- Androidproduct · 2
- OpenAIorganization · 2
- PromptSpymalware · 2
- Viettel Cyber Securityorganization · 2
- SharePointproduct · 2
- ChatGPTproduct · 2
- YuanKongmalware · 2
- Microsoftorganization · 2
- OpenAIvendor · 2
- Kasperskyvendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.