Flying Eagle RAT Abuses Android Accessibility Services for Keylogging, Screen Capture and Gesture Injection

A newly analyzed Android remote access trojan (RAT) dubbed “Flying Eagle” is leveraging Accessibility Services to enable large-scale surveillance, credential theft, and remote device manipulation, following its distribution through fake Public Security Bureau (PSB) applications.

A June 18, 2026 public warning from Chinese state media (CCTV) confirmed the campaign, highlighting fraudulent apps masquerading as official government services to lure victims into sideloading malicious APKs.

The initial infection vector centers on attacker-controlled domains such as 110gongan[.]com, where “GongAn” references China’s Public Security Bureau.

These apps request Accessibility permissions during installation, effectively granting the malware elevated privileges.

Once enabled, Flying Eagle can perform keylogging, capture screens, inject gestures via Android’s dispatchGesture API, and deploy phishing overlays targeting financial, government, and adult-themed applications.

Technical analysis reveals that Flying Eagle is not a standalone malware strain but a modular platform combining APK generation and command-and-control (C2) device management within a unified operator panel.

The builder framework, distributed via Telegram channels including “Yx科技” (Yx Technology) and “SQLRCE0,” allows threat actors to generate customized payloads with embedded phishing templates and encrypted C2 callbacks.

The underlying infrastructure shows clear signs of operational maturity. Initial indicators provided in the public notice, including IPs 207.56.30[.]188 and 207.56.30[.]194 hosted on Zillion Network Inc. (AS54801), revealed rotating TLS certificates tied to domains such as fusu.us[.]ci and ls.j2x8a[.]top.

Pivoting on certificate metadata uncovered additional infrastructure across Antbox Networks Limited (AS138995), including servers hosting Chinese-language admin panels titled “阿力科技” and “AdminPro.”

Hunt.io Researchers identified, at least 170 active servers associated with Flying Eagle infrastructure over a 30-day period, primarily concentrated in Hong Kong, with additional nodes in the United States, Canada, Finland, Malaysia, and Japan.

Consistent fingerprints included HTTP 302 redirects to HTTPS endpoints, Strict-Transport-Security headers, and default TLS certificates issued for xyttkx[.]cc subdomains.

Inside the leaked source archive “中国龙.zip” (Chinese Dragon), researchers identified a full Docker-based deployment stack including nginx, PHP, MySQL, and Node.js WebSocket services.

Eagle RAT Abuses Android

The APK builder module uses Java 11 and Android SDK tools to generate polymorphic malware samples by randomizing package names, obfuscating class identifiers, and injecting structured low-entropy padding to evade antivirus detection.

Core functionalities are mapped directly to class components such as LiveKeysStrok (keylogging), ScreenCaps (screen capture), Webjector (phishing overlays), and AccessibilityActivity (privilege abuse).

Notably, C2 communications are encrypted using AES-128-CBC with PBKDF2-derived keys, maintaining compatibility with a legacy Windows binary (EaodWorker.exe), suggesting cross-platform lineage.

Sandbox detections link Flying Eagle samples to SpyNote malware variants, with overlapping behaviors including Accessibility-based privilege escalation, Firebase and WebSocket communications, and dynamic overlay injection.

The builder also embeds Base64-encoded JSON assets (2.8–3.5 MB) to reduce entropy and bypass heuristic detection engines.

The ecosystem surrounding Flying Eagle expanded significantly after a source code compromise in early February 2026. Telegram channel SQLRCE0 claimed access to nearly 200 customer databases and subsequently released modified versions of the codebase with “fixed” backdoors, offering builds for approximately 2,000 USDT.

A parallel channel, Yx Technology, operationalized the malware by distributing tools, phishing templates, and even cash-out services for stolen funds, typically charging 20–50% commissions.

Evidence suggests the platform is evolving rapidly. On June 23, 2026, SQLRCE0 introduced a successor framework named “Night Dragon” (夜龙), featuring enhanced capabilities such as black-screen attack modes, automatic icon hiding, and targeted credential harvesting for Alipay, WeChat, banking apps, and cryptocurrency wallets.

Early infrastructure linked to Night Dragon remains limited but overlaps with known Flying Eagle hosting providers.

The convergence of leaked source code, active Telegram-based distribution, and globally distributed infrastructure underscores a growing trend in commoditized Android malware frameworks.

An illustrative example of the campaign’s scale is a discovered management panel exposing 46 infected devices, with 29 active sessions, enabling operators to access SMS, camera feeds, audio recording, and real-time screen control.

The interface also includes one-click deployment of phishing overlays tailored to specific financial applications.

Flying Eagle exemplifies how Accessibility Services continue to be abused as a powerful attack vector, enabling persistent, stealthy control over infected devices while evading traditional detection mechanisms.

What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist