Android Malware Exposes Its Own Operators While Hijacking Phones and Stealing Sensitive Data

An Android remote-access Trojan, YuanKong, whose weakly protected dropper reveals more than its hidden payload: it exposes the operator account identifiers embedded in each build.

Analysis of 110 droppers uncovered 57 distinct child payloads, 42 operator accounts and 44 rotating build brands, all tied together by a shared signing certificate and command-and-control (C2) infrastructure.

Its “SVLT-XOR-v2” routine uses a simple two-key XOR operation, allowing analysts to recover the child APK statically without running the malware or contacting its servers.

The extracted app identifies itself as YuanKong and is signed with a certificate shared across the 57 payloads a useful family-level detection anchor even as package names and branding change.

The more unusual exposure is in the app’s own configuration. Each build contains an operator account ID, account name and enrollment code as string constants.

YuanKong then includes those fields in telemetry sent to its C2 when the foreground app changes. In effect, a sample can reveal not only its capabilities but also the account associated with its build.

The researchers used that pattern to identify 42 distinct accounts across their collection.

YuanKong’s surveillance relies less on traditional data permissions than on control of the user interface. The analyzed build lacks permissions for SMS, contacts, call logs, camera and microphone access.

Instead, it abuses Android Accessibility services to inspect interface content, capture text changes including password-field activity and remotely tap, swipe, type and navigate.

It can stream the screen, read notifications and clipboard contents, collect files and location data, and present attacker-supplied overlays over selected apps to capture payment credentials.

Starlabs Researchers said that, the loader stores its decryption key and initialization vector in plaintext in assets/vault-config.json, beside the encrypted payload.

The malware also maps touches to keypad positions. By combining touch coordinates with detected keypad layouts, it can infer PIN entry without reading the digits directly from the app.

Android remote-access Trojan

A black-screen overlay can conceal some remote activity from the user. These techniques can expose credentials and enable fraudulent actions within banking or payment sessions, although the analysis does not establish how many devices have been infected.

The C2 is not a single hard-coded host. Three C2 domains are defined in k4.u3, two of which also carry a www. alias.

YuanKong’s local privilege escalation abuses Wireless Debugging rather than a software vulnerability. After obtaining Accessibility access, it can enable debugging, read pairing details from the system interface and pair with the device’s own Android Debug Bridge service.

This gives it shell-level access not root which it uses to grant additional permissions and strengthen persistence. The distinction matters: shell access expands control, but it is not equivalent to unrestricted root access.

The C2 channel uses persistent Socket.IO/Engine.IO WebSocket connections and typed JSON messages. The analyzed code showed no separate application-layer encryption; confidentiality depends on TLS.

Researchers identified a shared host set including apppanda[.]xyz, ktxapp[.]com, ktx123[.]net and 206.82.1.14.

They caution that package-name strings found in the configuration are seed material for device-identity generation, not C2 indicators or confirmed targets.

The findings echo a broader Android threat trend: RatHat, documented by Zimperium in September 2026, also combines Accessibility abuse with local ADB pairing, but uses a separate architecture and captures raw touch events through getevent.

STAR Labs says YuanKong instead relies on Accessibility and window-level touch data, making the comparison useful but not evidence of a shared operator or codebase.

For defenders, prioritize the shared YuanKong certificate and confirmed C2 indicators over changing app names. Investigate unfamiliar Accessibility services, unexpected Wireless Debugging activity and apps that request broad control without a clear need.

Users should avoid installing APKs from unsolicited links and review which apps have Accessibility access.

Do not block imitation package names solely because they appear in YuanKong’s configuration: the researchers specifically warn these strings are not reliable indicators.

Indicators of compromise

Type	Indicator	Context
C2 host	apppanda[.]xyz	Shared relay set, all tenants.
C2 host	ktxapp[.]com, www.ktxapp[.]com	Shared relay set.
C2 host	ktx123[.]net, www.ktx123[.]net	Shared relay set.
C2 host	206.82.1.14	Hardcoded IP, present in DEX, in all family records. The ktx domains resolved to this IP on 2026-10-15.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.