Source code for Flying Eagle, an Android remote access trojan framework, is circulating through criminal channels on Telegram. Hunt.io and independent researcher NetAskari traced matching control panels and TLS certificates to 170 internet-connected servers actively running the RAT infrastructure. The framework currently targets Chinese Android users through a fake “公安一网通办” (Public Security unified online service) application — a spoofed government portal designed to exploit users’ trust in official public safety interfaces. The kit captures payment passwords, intercepts SMS messages, harvests contacts, records calls, and provides remote device control.
The Fake Public Security App and Why the Spoofed Vector Is Effective
The Flying Eagle RAT’s primary distribution channel is a fake application impersonating a Chinese public security government portal. Government-branded applications hold implicit trust for many users, particularly in regions where official digital services have expanded rapidly and users are accustomed to downloading government-affiliated apps for services ranging from tax filing to health records. A user who receives a prompt or link to install what appears to be an official public security service is operating in an environment where such a request appears credible.
Once installed, the fake application grants the RAT full access to the victim’s device. The kit’s capability set is designed around financial theft and surveillance: payment-password theft targets mobile banking and payment applications, SMS interception captures one-time passwords used in two-factor authentication, call recording provides ongoing audio surveillance, and contact harvesting builds a directory of potential further targets. The combination of financial and surveillance capabilities indicates the framework is designed for operators running both monetary theft operations and intelligence-collection campaigns.
170 Active Servers Traced by Hunt.io and NetAskari
Hunt.io and researcher NetAskari identified 170 internet servers running control panels and certificates that match the Flying Eagle RAT framework — a number that indicates the framework is not confined to a single operator. Multiple separate deployments running the same infrastructure suggest that access to the RAT framework was already distributed before the source code reached Telegram’s criminal channels, or that early access enabled rapid parallel deployment. The 170-server figure represents active infrastructure, not historical or dormant systems.
The Source Code Release and Its Effect on the Threat Landscape
The circulation of Flying Eagle’s source code through Telegram changes the threat profile of this RAT family. Before source code becomes widely available, deploying a given RAT framework requires either purchasing it from the original operators, obtaining access through criminal markets at some cost, or independently replicating its functionality. Once source code is public, those barriers disappear. Any criminal operator with Android development knowledge can customize the codebase, build new variants, rebrand the framework, and deploy it against any target population they choose.
How Source Code Availability Multiplies Variant Production
RAT frameworks that lose source code control tend to proliferate rapidly into multiple variants. Each operator who modifies the code produces a new variant with potentially different network indicators, capability sets, and distribution tactics. This fragmentation makes tracking and attribution harder, as a single framework can evolve into dozens of independently operated variants within months of source code release.
The particular risk with government-impersonation distribution is that it scales geographically and contextually: the fake government app approach demonstrated against Chinese users can be adapted to spoof government portals in any country where Android adoption is high and official mobile services are common. A framework built for Chinese public security impersonation requires relatively modest modification to impersonate the public security agencies of other jurisdictions.
Indicators and Defensive Posture
Android users in China — and users in other regions once customized variants emerge — should install applications exclusively from official app stores and verify publisher credentials before granting permissions to any application claiming government affiliation. Official government applications in China are distributed through channels that can be verified against published registries; any application requesting installation from an unofficial source or direct download link claiming government affiliation should be treated as suspicious.
Organizations managing Android device fleets in China should alert users to the fake public security application distribution pattern and monitor for device behavior consistent with RAT installation: unexpected SMS forwarding, elevated data usage at unusual hours, and applications requesting call recording or contact access without a stated functional need. The source code release means the specific application names and package identifiers used in current campaigns may change quickly as new operators deploy modified variants — behavioral detection is more reliable than indicator-based blocking for this threat class.
