Flying Eagle source code circulates as researchers map 170 servers
Joint research published July 28, 2026, found Flying Eagle Android RAT fingerprints on 170 internet servers as the framework’s source code circulated through criminal Telegram channels. Hunt.io and researcher NetAskari stressed that the figure does not represent 170 victims, infected phones, operators or confirmed C2 systems.
Why the framework matters
Flying Eagle was linked to a fraudulent Chinese Public Security service application targeting Android users in China. Its functions include payment-password and keystroke capture, screen recording, camera access, device control and phishing prompts that imitate financial, adult-content and government-service apps.
The framework lowers the barrier to deploying customised malware. An operator can select a name, icon, lure and C2 address, then generate a signed APK from one of two templates.
How researchers identified the infrastructure
Hunt.io found 158 servers through the AdminPro page title, HTTPS redirect behaviour and matching response headers. Another 12 used the default TLS certificate packaged with Flying Eagle. The estimate is likely conservative because similar servers without the expected 302 redirect were excluded.
The leaked 388 MB archive, named Chinese Dragon, contains a Docker deployment with nginx, PHP, MySQL, a Node.js WebSocket server, Android build tools and phishing templates. The builder randomises package and class names, encrypts embedded C2 addresses with AES-128-CBC and adds 2.8 MB to 3.5 MB of low-entropy JSON padding.
Related criminal activity
Builder-generated samples were detected as SpyNote and abused Android accessibility services for privilege escalation and gesture injection. Two channels, SQLRCE0 and Yx Technology, distributed modified versions. Claims that 189 customer servers were compromised remain unverified. SQLRCE0 also promoted Night Dragon, an apparently independent Android kit; one exposed panel listed 46 online devices and 29 active connections, though these may have been test records.
For businesses, the response should focus on controlling APK installation, monitoring accessibility-service use and preparing rapid containment. If an unofficial app reaches a device, remove it, scan the handset, reset affected credentials and freeze payment channels immediately when funds may be at risk.
Flying Eagle Android RAT: how to interpret the findings
The 170 mapped servers show the visible infrastructure associated with the Flying Eagle Android RAT framework, not a confirmed count of victims or infected devices. The practical risk begins when a user installs a malicious APK and grants permissions that enable credential theft, surveillance or device control.
What the server count actually shows
Researchers identified 158 servers through shared AdminPro page behaviour and response patterns, plus 12 through the framework’s default TLS certificate. Similar deployments may remain uncounted, while a matching server does not by itself confirm an active operator, infected handset or command-and-control system.
- The figure does not represent 170 confirmed victims.
- A detected server does not prove that devices connected to it.
- The published estimate excludes servers without the expected redirect behaviour.
Where the device-level risk starts
Flying Eagle can generate customised, signed Android packages with selected names, icons, lures and server addresses. Once an unofficial APK reaches a device, phishing prompts and abuse of Android accessibility services can support keystroke capture, screen recording, gesture injection and device control.
- Treat APK files from unofficial channels as a security risk.
- Review unexpected requests to enable accessibility services.
- Be cautious when an unfamiliar app imitates a payment or government service.
Immediate response to a suspected installation
Containment should focus on the affected handset and any credentials or payment access used on it. Remove the unofficial application, scan the device and reset affected credentials. If funds may be at risk, freeze the relevant payment channels immediately.
- Remove the suspected APK from the handset.
- Scan the device for additional malicious software.
- Reset credentials that may have been entered or captured.
- Freeze payment channels promptly when financial access may be exposed.
Frequently asked questions
Does the Flying Eagle Android RAT finding confirm 170 infected devices?
No. The number refers to servers matching selected technical fingerprints. It does not confirm 170 victims, infected phones, malware operators or active command-and-control systems.
How can Flying Eagle gain control of an Android device?
The framework can package malicious functionality inside a customised APK. Its documented functions include phishing prompts, keystroke capture, screen recording, camera access and abuse of accessibility services for gesture injection.
What should a business do if an employee installed a suspicious APK?
Remove the app, scan the handset and reset credentials that may have been exposed. If payment access or funds could be affected, freeze the relevant payment channels immediately.