Flying Eagle Android RAT Found on 170 Servers as Source Code Circulates

Security researchers have identified traces of the Flying Eagle Android remote access trojan (RAT) framework on 170 internet servers, as its source code circulates through criminal Telegram channels. The discovery was made by Hunt.io and independent researcher NetAskari, who matched control panels and certificates to the servers.

The RAT is linked to a fake Public Security service application targeting Android users in China. It supports payment-password and keystroke capture, screen recording, camera access, and phishing prompts for financial, adult-content, and government-service applications. Hunt.io’s analysis of 30 days of telemetry found infrastructure fingerprints on 170 servers, though this does not confirm 170 infected devices or victims.

Researchers identified 158 servers through the AdminPro page title, HTTPS redirect behavior, and matching response headers, with an additional 12 found via a default certificate packaged with Flying Eagle. The total is considered conservative as it excluded similar servers that did not return the expected 302 redirect.

Chinese authorities have advised anyone who installed the fraudulent application to remove it, scan the device, change affected account passwords, freeze payment channels if funds moved, and report the incident to police. China’s National Cybersecurity Notification Center warned on June 18 that the fake application was being distributed from 110gongan[.]com, associated with 207.56.30[.]188, and could steal payment data and remotely control devices.

The Flying Eagle code was distributed as a 388 MB archive called Chinese Dragon, containing a full Docker deployment with nginx, PHP, MySQL, a Node.js WebSocket server, Android build tools, phishing templates, and a default TLS certificate. The panel allows operators to choose an app name, icon, lure text, and C2 address, then produces a signed APK from one of two templates. The builder randomizes package and class names, encrypts embedded C2 URLs using AES-128-CBC, and adds low-entropy JSON padding to resemble legitimate SDK configuration data.

Two Telegram channels, SQLRCE0 and Yx Technology, are distributing modified versions of the framework. SQLRCE0 also introduced a separate Android control kit called Night Dragon on June 23, 2026, which appears to be financially motivated Android crimeware, unrelated to the 2011 China-linked espionage campaign of the same name.