Flying Eagle is an Android remote access trojan (RAT) framework that supports payment-password and keystroke capture, screen recording, camera access, and phishing prompts. Its source code is circulating through criminal Telegram channels, and traces have been found on 170 servers.