Hunt.io researchers and independent journalist NetAskari started with a fraudulent Android app impersonating a Chinese Provincial Public Security Bureau service and ended up mapping a sprawling criminal ecosystem built around a leaked Android RAT framework called Flying Eagle, 飞鹰. The investigation found 170 active servers, two Telegram channels distributing modified versions of the stolen codebase, and a likely successor platform already in version 2 development. Chinese state media had already warned citizens about the fake police app in June 2026. Nobody had yet traced what was behind it.
“Analysis of the malware led to a Telegram channel distributing the source code for an undocumented Android application builder and device control framework called Flying Eagle (飞鹰). Hunt.io researchers pivoted on TLS certificates and panel fingerprints to identify 170 servers running the framework, and uncovered a fractured criminal ecosystem built around its leaked codebase.” reads the report published by Hunt.io. “Flying Eagle combines APK generation and full-featured C2 device management in a single panel, with phishing overlays for financial, adult, and government service apps. The source code was stolen in early 2026, along with nearly 200 customer databases, leading to multiple modified variants circulating across criminal actors”
The leak turned a single commercial RAT into an open toolkit that anyone willing to pay 2,000 USDT for a “fixed” version, or nothing at all for the free Docker release dropped on Telegram in April, could deploy.
The framework is more capable than most MaaS offerings at this price point.
“The APK generation module accepts user-defined lured text, application names, icons, and C2 callback addresses, then builds a signed APK using one of two base templates.” continues the report. “Additional observed templates: Chinese adult streaming services, TikTok, financial applications, and landing pages for public welfare projects that send the number of visits and downloads back to the operator.”
To evade antivirus detection, the builder pads APKs with fake JSON configuration data and encrypts C2 callback URLs using AES-128-CBC with hardcoded cryptographic parameters.
The original class names in the source code tell you exactly what the tool does: RecordPayPassword, LiveKeysStrok, ScreenCaps, Webjector, CameraCap. At build time all of those get replaced with randomized 8-to-14 character strings, so static analysis hits a wall immediately.
Hunt.io identified the broader infrastructure through two independent fingerprints: the AdminPro title that briefly appears before operator branding loads, combined with a consistent HTTP 302 redirect behavior and Strict-Transport-Security header. A separate query for servers still running the default TLS certificate packaged with the Flying Eagle Docker deployment added another 12 unique servers. The pivot that connected the Docker version to a separate Windows XAMPP deployment was a misspelled environment variable, SECRIT_KEY, present in both codebases. Someone left a typo in the source, and it followed every fork.
The two Telegram channels operating around Flying Eagle have different roles. Yx科技 functions as sales and operational support: its first messages were step-by-step instructions for draining Alipay and WeChat accounts, referring to victims as “fish” and offering cash-out services at 20 to 50 percent transaction fees.
The SQLRCE0 Telegram channel, created in February 2026, was among the first to distribute Flying Eagle-related files. Researchers found that its posts indicated a leak of the RAT’s source code, including a chat screenshot between an unidentified actor and the malware developers known as “Flying Eagle Tech.”
“The chat showed a negotiation over access to 189 Feiying server and exfiltrated database, with the unknown party claiming to have compromised customer infrastructure.” continues the report. “SQLRCE0 used the ensuing messages to make multiple fixes to the leaked source code: domain connectivity, WebSocket stability, anti-uninstall features, and more all while assuring users with a money back guarantee that all backdoors had been removed from the code.”
A money-back guarantee on a backdoor-free criminal RAT. The market for this stuff is apparently competitive enough to require customer service.
On June 23, three weeks after Chinese state media published the public safety notice, SQLRCE0 introduced Night Dragon, 夜龙,as an independently developed successor. It’s not a reskin of Flying Eagle: it’s a separate build, currently in version 2 development as of July 12. Night Dragon adds a black-screen mode that shows a fake system update to hide operator activity, automatic icon hiding after installation, and single-click credential capture overlays for Alipay, WeChat, ICBC, Construction Bank, Agricultural Bank, and cryptocurrency wallets TokenPocket and imToken.
Hunt.io found one exposed Night Dragon panel showing 46 devices online with 29 actively connected, all geolocated in China. Whether those are real victims or test data is unverified. The operator account names translate to variants of “get rich,” which at least makes the intent clear.
“The device control interface provides full remote access including live screen viewing, SMS and photo gallery access, audio recording, camera capture, and file management. A phishing overlay system allows operators to deploy credential capture prompts for specific applications, with single-click shortcuts for Alipay, WeChat, and major Chinese banks including ICBC, Construction Bank, and Agricultural Bank, in addition to cryptocurrency wallets TokenPocket and imToken.” concludes the report. “Night Dragon represents an evolution beyond the variants of Flying Eagle. Where Yx Technology and SQLRCE0 both distributed modified versions of an existing codebase, this project appears to be an independent build, which is currently in active version 2 development as of July 12th. Its emergence just three weeks after the public safety notice suggests the demand for Chinese-language Android RAT tooling continues to drive criminal actors even as existing platforms are exposed.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Flying Eagle)