Back Feeds.Feedburner

Flying Eagle Android RAT source code circulates on Telegram

Feeds.Feedburner •SC Staff • July 30, 2026

The source code for the Flying Eagle Android remote access trojan (RAT) framework is being shared on criminal Telegram channels. Researchers from Hunt.io and NetAskari have identified 170 internet servers linked to matching control panels and certificates, according to a recent report by The Hacker News.

The Flying Eagle framework is being distributed as a fake "公安一网通办" Public Security service application targeting Android users in China. This kit enables attackers to capture payment passwords and keystrokes, record screens, access cameras, and deploy phishing prompts for financial, adult-content, and government applications. Researchers found 158 servers through specific page titles and redirect behaviors, identifying an additional 12 via a default certificate. The total server count is considered conservative.

Chinese authorities have advised users who installed the fraudulent app to remove it, scan their devices, change passwords, and report the incident. The distribution of the Flying Eagle source code and the identified server infrastructure are documented, but a direct causal link has not been established. The framework is detected as SpyNote and utilizes Android accessibility services for privilege escalation.

Source: The Hacker News

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Flying Eagle Android RAT Targets Users with Fake Public Security Apps The Flying Eagle Android remote access trojan (RAT) is being distributed via fraudulent applications impersonating China's Public Security Bureau. Researchers from Hunt.io and NetAskari identified 170 servers linked to this malware, which captures sensitive information such as payment passwords and keystrokes. The malware utilizes Android Accessibility Services for extensive device control, including screen recording and camera access. Chinese authorities have issued warnings advising users to remove the fake app and secure their devices. The source code for Flying Eagle was leaked earlier in 2026, leading to the emergence of patched variants on Telegram. A successor platform named Night Dragon is also under development, indicating a potential escalation in threat capabilities. The total server count is believed to be conservative, with ongoing distribution efforts noted in Telegram channels. 4 sources 71

Extracted Entities

Flying Eagle Android RAT source code circulates on Telegram

The full story

Extracted Entities

Attack Types (3)

Countries (1)

Domains (1)

Malware (2)

MITRE ATT&CK (2)

Platforms (1)