Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates
Summary: Source code for the Flying Eagle Android remote access trojan framework is circulating through criminal Telegram channels, and researchers at Hunt.io and independent researcher NetAskari traced matching control panels and certificates to 170 internet servers. The kit, distributed as a 388 MB archive called 中国龙.zip, supports payment-password and keystroke capture, screen recording, camera access, and phishing prompts, and was linked to a fake "公安一网通办" Public Security application targeting Android users in China.
Why it matters: Hunt.io's 170-server count comes from just 30 days of telemetry and excludes similar servers that did not return the expected 302 redirect, so the researchers call it conservative - and the builder's 2.8 MB to 3.5 MB of JSON padding is designed to look like legitimate SDK configuration data to whatever is scanning your network.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026