Researchers have identified YuanKong, an Android remote access trojan capable of controlling infected devices, capturing payment PINs, and masking malicious activity. The malware utilizes accessibility abuse, fake payment screens, and local Android debugging access to facilitate device takeover and potential financial fraud. The investigation analyzed 110 dropper applications, revealing 57 distinct malicious payloads.

All payloads shared a single signing certificate, while embedded account details indicated 42 operator accounts and 44 rotating build brands. However, its protection is weak; a configuration file named `vault-config.json` contains the decoding key and initialization value in plain text. Once active, YuanKong leverages Android accessibility features to inspect screen content, record text changes, and perform taps, swipes, and navigation commands.

One technique involves displaying a fake numeric keypad and recording the actual digits while showing masked dots. Another approach maps the positions of digit buttons in an application's accessibility tree, then uses captured touch coordinates to identify selected numbers. The malware can hide its application icon and employs a Socket.IO over WebSocket persistent control channel, exchanging structured messages protected by TLS.

Embedded operator identifiers accompany device reports, enabling researchers to link different builds to specific accounts, as Starlabs has stated.