Flying Eagle RAT Abuses Android Accessibility Services for Keylogging, Screen Capture and Gesture Injection

Gbhackers •Mayura Kathir • July 29, 2026

A newly analyzed Android remote access trojan (RAT) dubbed “Flying Eagle” is leveraging Accessibility Services to enable large-scale surveillance, credential theft, and remote device manipulation, following its distribution through fake Public Security Bureau (PSB) applications. A June 18, 2026 public warning from Chinese state media (CCTV) confirmed the campaign, highlighting fraudulent apps masquerading as official […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Flying Eagle Android RAT Targets Users with Fake Public Security Apps The Flying Eagle Android remote access trojan (RAT) is being distributed via fraudulent applications impersonating China's Public Security Bureau. Researchers from Hunt.io and NetAskari identified 170 servers linked to this malware, which captures sensitive information such as payment passwords and keystrokes. The malware utilizes Android Accessibility Services for extensive device control, including screen recording and camera access. Chinese authorities have issued warnings advising users to remove the fake app and secure their devices. The source code for Flying Eagle was leaked earlier in 2026, leading to the emergence of patched variants on Telegram. A successor platform named Night Dragon is also under development, indicating a potential escalation in threat capabilities. The total server count is believed to be conservative, with ongoing distribution efforts noted in Telegram channels. 4 sources 71

Extracted Entities

Flying Eagle RAT Abuses Android Accessibility Services for Keylogging, Screen Capture and Gesture Injection

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)