Flying Eagle Android RAT Targets Users with Fake Public Security Apps

The Flying Eagle Android remote access trojan (RAT) is being distributed via fraudulent applications impersonating China's Public Security Bureau. Researchers from Hunt.io and NetAskari identified 170 servers linked to this malware, which captures sensitive information such as payment passwords and keystrokes. The malware utilizes Android Accessibility Services for extensive device control, including screen recording and camera access. Chinese authorities have issued warnings advising users to remove the fake app and secure their devices. The source code for Flying Eagle was leaked earlier in 2026, leading to the emergence of patched variants on Telegram. A successor platform named Night Dragon is also under development, indicating a potential escalation in threat capabilities. The total server count is believed to be conservative, with ongoing distribution efforts noted in Telegram channels.

Key Points: • Flying Eagle RAT is distributed through fake Public Security Bureau apps targeting Android users. • 170 servers linked to the Flying Eagle framework have been identified, with ongoing distribution on Telegram. • Chinese authorities have issued warnings and recommended users to remove the fraudulent app and secure their devices.