The source code for the Flying Eagle Android remote access trojan (RAT) framework has been circulating in criminal Telegram channels, leading to its deployment across numerous servers. Security researchers from Hunt.io and independent analyst NetAskari have identified matching control panels and certificates on 170 internet servers, indicating widespread use of this malicious toolkit.
Flying Eagle is associated with a counterfeit application mimicking the Chinese Public Security service app, “公安一网通办.” This fraudulent app targets Android users in China, offering capabilities such as capturing payment passwords and keystrokes, recording screens, accessing cameras, and presenting phishing prompts for financial, adult-content, and government-service applications.
In their analysis, Hunt.io examined telemetry data from the past 30 days and discovered infrastructure fingerprints of Flying Eagle on 170 servers. It’s important to note that this figure does not directly correspond to the number of infected devices, victims, operators, or confirmed command-and-control (C2) systems.
The researchers identified 158 servers through specific indicators, including the AdminPro page title, HTTPS redirect behavior, and matching response headers. An additional 12 servers were found via a default certificate bundled with Flying Eagle. The actual number of affected servers is likely higher, as some servers with similar characteristics did not return the expected 302 redirect during analysis.
Chinese authorities have issued warnings to users who may have installed the fraudulent application. They advise immediate removal of the app, thorough device scanning, changing of affected account passwords, freezing of payment channels if unauthorized transactions are detected, and reporting the incident to local police.
On June 18, China’s National Cybersecurity Notification Center highlighted that the fake application was being distributed from the domain 110gongan[.]com, linked to the IP address 207.56.30[.]188. This malicious app is capable of stealing payment data and remotely controlling infected devices.
Further investigation revealed that the Flying Eagle code was disseminated as a 388 MB archive named 中国龙.zip, or Chinese Dragon. This archive includes a comprehensive Docker deployment featuring nginx, PHP, MySQL, a Node.js WebSocket server, Android build tools, phishing templates, and a default Transport Layer Security certificate.
The control panel within this toolkit allows operators to customize app names, icons, lure texts, and C2 addresses, subsequently generating a signed APK from one of two templates. The builder randomizes package and class names, encrypts embedded C2 URLs using AES-128-CBC, and incorporates 2.8 MB to 3.5 MB of low-entropy JSON padding designed to mimic legitimate software development kit configuration data.
Flying Eagle serves as both the builder and control framework. Samples analyzed from the builder were detected as SpyNote and utilized Android accessibility services for privilege escalation and gesture injection.
Researchers observed two Telegram channels, SQLRCE0 and Yx Technology, distributing modified versions of the Flying Eagle framework. Messages reviewed indicated that an unidentified party had compromised infrastructure containing 189 Flying Eagle servers and exfiltrated database data, though these claims have not been independently verified. Additionally, Yx Technology advertised cash-out services, charging between 20% to 50% of the transaction value.
While the circulation of the source code and the number of identified servers are documented, no direct causal relationship between them has been established.
In a related development, SQLRCE0 introduced another Android control kit named Night Dragon on June 23, 2026. Researchers found two associated servers and an exposed panel listing 46 devices as online and 29 as actively connected. However, it remains unclear whether these entries represent actual victims or test data. Night Dragon appears to be an independent build, with a second version in development as of July 12. Notably, this 2026 kit is financially motivated Android crimeware and is unrelated to the 2011 China-linked espionage campaign also named Night Dragon.
The proliferation of the Flying Eagle RAT underscores the evolving landscape of Android malware. The availability of its source code in criminal forums facilitates the rapid development and deployment of customized malicious applications, posing significant threats to users worldwide. This situation highlights the critical need for robust cybersecurity measures, user vigilance, and prompt action by authorities to mitigate the risks associated with such advanced malware frameworks.
