A newly analyzed Android remote-access Trojan called YuanKong can monitor a victim’s screen, capture banking credentials and let a remote operator control the device. Its design is notable because it does not depend on the broad collection of SMS messages, contacts, call logs, camera feeds or microphone audio seen in some mobile threats. Instead, it turns Android’s Accessibility functions and screen interfaces into a powerful surveillance channel.

Researchers at Star Labs examined 110 droppers and 57 distinct child payloads signed with the same YuanKong certificate. Different embedded operator accounts appeared across the samples, suggesting a shared malware service used by multiple customers or affiliates. Analysts linked 42 operator accounts, though the research did not determine how many devices were infected or how victims were persuaded to install the apps.

A dropper conceals the remote-control payload

The first application acts as a loader. It carries an encrypted child app, unpacks it and installs the payload on the device. The decryption material is stored beside the concealed data, and the protection relies on a simple XOR operation. That makes the hidden app recoverable during analysis without contacting the attacker’s infrastructure.

Once installed, the child identifies itself as YuanKong and connects to command-and-control servers with Socket.IO and WebSocket. Messages use typed JSON and travel through TLS, but researchers did not find a separate encryption layer inside that connection. The control channel supports screen captures, file transfers, location collection, clipboard access, notification reading, and remote taps or swipes.

Accessibility reveals what users type

YuanKong can read text exposed through Accessibility events, including changes to input fields, and inspect the accessibility tree for password elements. It also offers several ways to steal numeric secrets. A counterfeit keypad can record the real digits while showing masked dots, while coordinate mapping can infer numbers tapped on some genuine on-screen keypads.

For payment apps, an operator can supply a web page and display it as an overlay above a chosen application. A victim believes the prompt belongs to the legitimate service, but the entered PIN goes to the malware. This means using a genuine banking app does not necessarily protect a user once an untrusted program has gained powerful Accessibility rights.

Wireless Debugging strengthens persistence

The malware can use Accessibility automation to enable Wireless Debugging, read the pairing details shown on the phone and connect to the local Android Debug Bridge service. That produces a shell-level session. It is not a root exploit, but it can still grant permissions and install a persistence script that helps the implant survive.

YuanKong can hide its launcher icon, run services that restart each other, resist removal and queue stolen records until connectivity returns. Together, these features make a compromised phone an interactive remote endpoint rather than merely a source of periodically collected data.

Detection must focus on behavior and trust

Package names and branding can change easily, so defenders should combine multiple signals. The shared signing certificate found by researchers, known infrastructure, unexpected Accessibility services and suspicious Wireless Debugging activity provide stronger leads than an app name alone. Organizations managing Android devices should monitor for unauthorized ADB use and remote-control behavior, then validate any match with local telemetry.

• Install applications only from trusted stores and approved enterprise channels.
• Review which apps have Accessibility access and revoke permissions that are not clearly required.
• Keep Wireless Debugging disabled unless it is actively needed for development.
• Treat unexplained overlays, disappearing icons and remote input as possible compromise signals.
• If infection is suspected, contact the bank through an official channel and change credentials from a separate trusted device.

The examined sample contacted infrastructure including apppanda[.]xyz, ktxapp[.]com, ktx123[.]net and 206[.]82[.]1[.]14. These indicators are intentionally defanged and should be handled in controlled security tools. Because infrastructure can be shared, abandoned or reassigned, no single indicator is conclusive. The enduring risk is the permission chain: an unfamiliar app with Accessibility control can observe and manipulate far more than many users expect.