Defenders Trace YuanKong to 42 Operators via Embedded IDs in Android Droppers
Analysis of YuanKong droppers reveals embedded operator account identifiers, allowing defenders to trace builds to specific threat actors and identify C2 infrastructure.
Key points
- YuanKong droppers contain plaintext operator IDs and enrollment codes that link malware builds to specific threat actor accounts.
- The malware uses Android Accessibility services to capture credentials and manipulate interfaces without standard SMS or camera permissions.
- Researchers identified 42 distinct operator accounts across 110 droppers, all sharing a common signing certificate and command-and-control infrastructure.
An Android remote-access Trojan named YuanKong exposes operator account identifiers embedded in each build, according to a report by GBHackers. The malware’s dropper stage contains operator account IDs, account names, and enrollment codes as string constants. These details are transmitted to the command-and-control server when the foreground application changes. This design allows security analysts to identify the account associated with a specific malware build.
The risk
The threat lies in the malware's ability to hijack user sessions without triggering traditional permission alerts. YuanKong does not request access to SMS, contacts, call logs, cameras, or microphones, according to the GBHackers analysis. Instead, it abuses Android Accessibility services to inspect interface content and capture text changes, including activity in password fields. The malware can remotely tap, swipe, type, and navigate the device, stream the screen, and read notifications and clipboard contents. It can also present attacker-supplied overlays over banking or payment apps to capture credentials.
Who is exposed
The GBHackers report notes that the malware can infer PIN entry by mapping touch coordinates to keypad positions, bypassing the need to read digits directly. A black-screen overlay can conceal remote activity from the user. These techniques can expose credentials and enable fraudulent actions within banking or payment sessions, although the analysis does not establish how many devices have been infected. Researchers identified 42 distinct accounts across their collection of 110 droppers.
Cost and compliance
The source material does not provide specific data on financial costs or compliance impacts for organisations. The analysis focuses on the technical capabilities of the malware and the exposure of operator identifiers. The shared signing certificate serves as a useful family-level detection anchor, even as package names and branding change. The command-and-control infrastructure is not a single hard-coded host, complicating simple blocking efforts.
What happens next
Managers should review mobile device management policies to ensure that Android Accessibility services are restricted to approved applications only. Security teams should monitor for applications sharing the YuanKong signing certificate, as this serves as a family-level detection anchor. Organisations should also verify that their endpoint detection solutions can identify the plaintext configuration files containing operator IDs, which may appear in legitimate-looking apps.
Questions to ask your suppliers
Ask your mobile device management provider whether their policies can restrict third-party applications from accessing Android Accessibility services. Inquire if your endpoint detection solution can identify apps based on shared signing certificates, which helps track malware families like YuanKong. Determine whether your supplier can detect configuration files containing plaintext operator identifiers or enrollment codes within installed applications. Ensure your incident response team knows how to investigate interface-level attacks that do not trigger traditional permission alerts.
What to do and how to stay safe: YuanKong
- Restrict Android Accessibility services to only trusted, organisation-approved applications to prevent interface hijacking.
- Monitor for applications signed with certificates associated with known malware families, such as the one used by YuanKong.
- Check for unusual configuration files containing plaintext operator IDs or enrollment codes in installed app assets.
- Educate users to look for black-screen overlays or unexpected navigation that may indicate remote control of their device.
Step-by-step guide: Data Breach Myths: Why Common Security Beliefs Fail
General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does YuanKong access SMS or camera data?
No, the analyzed build lacks permissions for SMS, contacts, call logs, camera, and microphone access, according to the GBHackers report.
How does YuanKong capture credentials?
It uses Android Accessibility services to inspect interface content, capture text changes, and present overlays over payment apps to steal credentials.
Can YuanKong builds be traced to specific operators?
Yes, each build contains an operator account ID, name, and enrollment code that are sent to the C2 server, allowing for forensic tracing.
