Source code for the Flying Eagle Android remote access trojan (RAT) framework is circulating through criminal Telegram channels. Hunt.io and independent researcher NetAskari traced matching control panels and certificates to 170 internet servers.
They linked the framework to a fake “公安一网通办” Public Security service application targeting Android users in China. The kit supports payment-password and keystroke capture, screen recording, camera access, and phishing prompts for financial, adult-content, and government-service applications.
Hunt.io’s search of the preceding 30 days of telemetry found infrastructure fingerprints on 170 servers, a count that does not establish 170 infected phones, victims, operators, or confirmed command-and-control (C2) systems.
The researchers found 158 servers through the AdminPro page title, HTTPS redirect behaviour, and matching response headers, then identified 12 more through a default certificate packaged with Flying Eagle. They said the total is likely conservative because it excluded otherwise similar servers that did not return the expected 302 redirect.
Chinese authorities advised anyone who installed the fraudulent application to remove it, scan the device, change affected account passwords, freeze payment channels if funds moved, and report the incident to police.
China’s National Cybersecurity Notification Center warned on June 18 that the fake application was being distributed from 110gongan[.]com, associated with 207.56.30[.]188, and could steal payment data and remotely control devices.
According to joint research published July 28, the Flying Eagle code was distributed as a 388 MB archive called 中国龙.zip, or Chinese Dragon. It contains a full Docker deployment with nginx, PHP, MySQL, a Node.js WebSocket server, Android build tools, phishing templates, and a default Transport Layer Security certificate.
The panel lets an operator choose an app name, icon, lure text, and C2 address, then produces a signed APK from one of two templates. The builder randomises package and class names, encrypts embedded C2 URLs using AES-128-CBC, and adds 2.8 MB to 3.5 MB of low-entropy JSON padding designed to resemble legitimate software development kit configuration data.
Flying Eagle is the builder and control framework; Hunt.io said samples it analysed from the builder were detected as SpyNote and used Android accessibility services for privilege escalation and gesture injection.
The researchers observed two Telegram channels, SQLRCE0 and Yx Technology, distributing modified versions of the framework. Messages reviewed by them claimed an unidentified party had compromised customer infrastructure containing 189 Flying Eagle servers and exfiltrated database data, but neither claim has been independently confirmed. Yx Technology also advertised cash-out services charging 20% to 50% of the transaction value.
The server count and the source-code circulation are documented, but no causal relationship between them has been established.
SQLRCE0 introduced a separate Android control kit called Night Dragon on June 23, 2026. The researchers found two associated servers and an exposed panel that listed 46 devices as online and 29 as actively connected, but said it could not determine whether the entries represented victims or test data.
Hunt.io says Night Dragon appears to be an independent build, with a second version in development as of July 12. The report establishes that SQLRCE0 distributed Flying Eagle and promoted Night Dragon, but it does not establish shared code. This is not the 2011 China-linked espionage campaign McAfee named Night Dragon. The 2026 kit is financially motivated Android crimeware.
