Flying Eagle Android RAT source code circulates on Telegram

The source code for the Flying Eagle Android remote access trojan (RAT) framework is being shared on criminal Telegram channels. Researchers from Hunt.io and NetAskari have identified 170 internet servers linked to matching control panels and certificates, according to a recent report by The Hacker News.

The Flying Eagle framework is being distributed as a fake "公安一网通办" Public Security service application targeting Android users in China. This kit enables attackers to capture payment passwords and keystrokes, record screens, access cameras, and deploy phishing prompts for financial, adult-content, and government applications. Researchers found 158 servers through specific page titles and redirect behaviors, identifying an additional 12 via a default certificate. The total server count is considered conservative.

Chinese authorities have advised users who installed the fraudulent app to remove it, scan their devices, change passwords, and report the incident. The distribution of the Flying Eagle source code and the identified server infrastructure are documented, but a direct causal link has not been established. The framework is detected as SpyNote and utilizes Android accessibility services for privilege escalation.

Source: The Hacker News