Flying Eagle Android RAT Source Code Leaks, Fingerprints Spotted on 170 Servers
Source code for a Chinese-language Android remote access trojan framework called Flying Eagle is doing the rounds on criminal Telegram channels, and researchers have already found its infrastructure fingerprints on 170 internet-facing servers.
Hunt.io and independent researcher NetAskari published joint findings on July 28, linking the framework to a fake public security app impersonating China's "公安一网通办" government service portal. The malware targets Android users and comes with a fairly complete feature set: payment credential and keystroke capture, screen recording, camera access, and phishing overlays for banking, adult content, and government-service apps.
The 170-server figure deserves some context before anyone runs with it. Researchers found 158 of those servers by fingerprinting the AdminPro panel title, HTTPS redirect patterns, and response headers. A default TLS certificate bundled with the framework led them to 12 more. They also acknowledge the count is probably conservative, since servers that didn't return the expected 302 redirect were excluded even when other indicators matched. Importantly, 170 servers does not mean 170 victims, 170 operators, or 170 confirmed command-and-control systems. It means 170 servers with matching fingerprints.
The kit itself was distributed as a 388 MB archive named 中国龙.zip, or Chinese Dragon. Inside is a full Docker deployment stack covering nginx, PHP, MySQL, a Node.js WebSocket server, Android build tools, phishing templates, and a default TLS certificate. An operator can configure an app name, icon, lure text, and C2 address, then get a signed APK out the other end. The builder randomises package and class names, encrypts embedded C2 URLs with AES-128-CBC, and pads the payload with 2.8 MB to 3.5 MB of low-entropy JSON designed to mimic legitimate SDK configuration files.
Flying Eagle is the builder and panel; the samples Hunt.io analysed were detected as SpyNote and used Android accessibility services for privilege escalation and gesture injection.
China's National Cybersecurity Notification Center flagged the fraudulent app on June 18, naming 110gongan[.]com and the IP 207.56.30[.]188 as distribution points. Authorities advised anyone who installed it to remove it immediately, scan the device, change passwords, freeze payment channels if money moved, and report to police.
Two Telegram channels, SQLRCE0 and Yx Technology, were observed distributing modified versions of the framework. Messages in those channels claimed an unnamed party had compromised infrastructure containing 189 Flying Eagle servers and pulled database contents. Neither claim has been verified. Yx Technology also advertised cash-out services with a 20 to 50 percent cut, which tells you everything you need to know about who's running this.
SQLRCE0 also introduced a separate Android control kit called Night Dragon on June 23, 2026. Researchers found two associated servers and an exposed panel listing 46 devices as online and 29 as actively connected. Whether those are real victims or test data is unknown. Hunt.io describes Night Dragon as an independent build with a second version apparently in development as of July 12. There's no evidence of shared code with Flying Eagle beyond the same distribution channel.
One thing worth being clear about: this is not the Night Dragon espionage campaign McAfee named back in 2011. The 2026 kit is financially motivated Android crimeware. Same name, entirely different operation.