--- title: 'Flying Eagle' Full-Service Mobile RAT Builder Wings... description: Chinese cybercriminals are leveraging a sophisticated malware-as-a-service (MaaS) framework called 'Flying Eagle' to build Android remote access trojans (RATs)... canonical: https://daily.dev/posts/flying-eagle-full-service-mobile-rat-builder-wings-across-china-8xku3rpjc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 'Flying Eagle' Full-Service Mobile RAT Builder Wings Across China | daily.dev og:description: Chinese cybercriminals are leveraging a sophisticated malware-as-a-service (MaaS) framework called 'Flying Eagle' to build Android remote access trojans (RATs)... og:url: https://daily.dev/posts/flying-eagle-full-service-mobile-rat-builder-wings-across-china-8xku3rpjc og:image: https://api.daily.dev/og/posts/8xKu3Rpjc.png og:image:alt: 'Flying Eagle' Full-Service Mobile RAT Builder Wings Across China og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 'Flying Eagle' Full-Service Mobile RAT Builder Wings Across China **[Dark Reading](https://daily.dev/sources/dr)** · 6 min read · 1 upvotes · 0 comments ## Summary Chinese cybercriminals are leveraging a sophisticated malware-as-a-service (MaaS) framework called 'Flying Eagle' to build Android remote access trojans (RATs) targeting popular finance apps. Packaged as a Docker deployment, Flying Eagle provides everything needed to launch mobile malware campaigns — APK/SDK build tools, phishing templates mimicking TikTok and financial apps, keylogging, overlay injection, and AV evasion techniques. After leaking into the broader Chinese cybercriminal underground, it spread via Telegram channels and spawned a successor called 'Night Dragon,' which adds live screen capture, microphone/camera access, and overlay attacks on major Chinese banks including ICBC, Agricultural Bank of China, and AliPay. Researchers traced the ecosystem back to IP addresses flagged in a June 2026 Chinese government warning, uncovering over 170 active servers running Flying Eagle. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Flying Eagle malware-as-a-service kit and what does it let attackers do? Flying Eagle is a mobile malware-as-a-service builder distributed as a full Docker deployment with a web server, WebSocket server, PHP, MySQL, APK/SDK build tools, and phishing templates mimicking TikTok, adult services, financial apps, and government portals. It lets low-skill criminals build Android RATs that steal payment credentials, screenshots, keystrokes, and camera access, and inject overlays into banking and financial apps. _Track fast-moving mobile threat research like this on daily.dev to stay ahead of emerging malware kits._ ### What is Night Dragon malware and how does it differ from Flying Eagle? Night Dragon is a more advanced Android remote-access kit released by the group behind Flying Eagle's support channel, launched five days after China's official warning about Flying Eagle. It captures live screen views, microphone audio, and camera feeds, accesses SMS and photo galleries, injects overlays into AliPay, WeChat, crypto wallets, and banks like ICBC, hides its own app icon, and can display a fake black update screen during remote sessions. Despite being more capable, it runs on only a couple of active servers compared to Flying Eagle's hundreds. _Developers securing banking and fintech apps can follow overlay-injection threats like this via daily.dev._ ### How did researchers discover the Flying Eagle malware operation? Researchers NetAskari and hunt.io traced the campaign starting from two IP addresses listed in a June 18 warning issued by China's National Cybersecurity Reporting Center on WeChat about fake public-safety apps. Following those IPs revealed a broader cybercriminal ecosystem, including Telegram channels like SQLRCE0 that sold a repaired version of Flying Eagle for $2,000 in Tether cryptocurrency and later distributed the Night Dragon tool. _Security teams tracing threat infrastructure from IOCs can find similar investigative writeups on daily.dev._ ## Similar posts on daily.dev - [GhostBat RAT: Inside the Resurgence of RTO-Themed Android Malware](https://daily.dev/posts/ghostbat-rat-inside-the-resurgence-of-rto-themed-android-malware-oxvv6boqh) · Cyble · 0 upvotes · 0 comments - [Chinese hackers use new Atlas RAT malware in European cyberattacks](https://daily.dev/posts/chinese-hackers-use-new-atlas-rat-malware-in-european-cyberattacks-5qumtgolr) · BleepingComputer · 0 upvotes · 0 comments - [New Albiriox MaaS Malware Targets 400\+ Apps for On-Device Fraud and Screen Control](https://daily.dev/posts/new-albiriox-maas-malware-targets-400-apps-for-on-device-fraud-and-screen-control-g4hvvyz6g) · The Hacker News · 0 upvotes · 0 comments - [New RatHat Android malware uses AI to automate device control](https://daily.dev/posts/new-rathat-android-malware-uses-ai-to-automate-device-control-feww6fso2) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#docker](https://daily.dev/tags/docker), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/flying-eagle-full-service-mobile-rat-builder-wings-across-china-8xku3rpjc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"'Flying Eagle' Full-Service Mobile RAT Builder Wings Across China","url":"https://daily.dev/posts/flying-eagle-full-service-mobile-rat-builder-wings-across-china-8xku3rpjc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/flying-eagle-full-service-mobile-rat-builder-wings-across-china-8xku3rpjc"},"datePublished":"2026-07-30T00:35:04.100Z","dateModified":"2026-09-14T08:30:48.082Z","description":"Chinese cybercriminals are leveraging a sophisticated malware-as-a-service (MaaS) framework called 'Flying Eagle' to build Android remote access trojans (RATs)...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d5c5b0afc49fcc00fdb0386894cf589e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d5c5b0afc49fcc00fdb0386894cf589e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/flying-eagle-full-service-mobile-rat-builder-wings-across-china-8xku3rpjc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"docker,malware","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"'Flying Eagle' Full-Service Mobile RAT Builder Wings Across China"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/flying-eagle-full-service-mobile-rat-builder-wings-across-china-8xku3rpjc#faq","mainEntity":[{"@type":"Question","name":"What is the Flying Eagle malware-as-a-service kit and what does it let attackers do?","acceptedAnswer":{"@type":"Answer","text":"Flying Eagle is a mobile malware-as-a-service builder distributed as a full Docker deployment with a web server, WebSocket server, PHP, MySQL, APK/SDK build tools, and phishing templates mimicking TikTok, adult services, financial apps, and government portals. It lets low-skill criminals build Android RATs that steal payment credentials, screenshots, keystrokes, and camera access, and inject overlays into banking and financial apps. Track fast-moving mobile threat research like this on daily.dev to stay ahead of emerging malware kits."}},{"@type":"Question","name":"What is Night Dragon malware and how does it differ from Flying Eagle?","acceptedAnswer":{"@type":"Answer","text":"Night Dragon is a more advanced Android remote-access kit released by the group behind Flying Eagle's support channel, launched five days after China's official warning about Flying Eagle. It captures live screen views, microphone audio, and camera feeds, accesses SMS and photo galleries, injects overlays into AliPay, WeChat, crypto wallets, and banks like ICBC, hides its own app icon, and can display a fake black update screen during remote sessions. Despite being more capable, it runs on only a couple of active servers compared to Flying Eagle's hundreds. Developers securing banking and fintech apps can follow overlay-injection threats like this via daily.dev."}},{"@type":"Question","name":"How did researchers discover the Flying Eagle malware operation?","acceptedAnswer":{"@type":"Answer","text":"Researchers NetAskari and hunt.io traced the campaign starting from two IP addresses listed in a June 18 warning issued by China's National Cybersecurity Reporting Center on WeChat about fake public-safety apps. Following those IPs revealed a broader cybercriminal ecosystem, including Telegram channels like SQLRCE0 that sold a repaired version of Flying Eagle for $2,000 in Tether cryptocurrency and later distributed the Night Dragon tool. Security teams tracing threat infrastructure from IOCs can find similar investigative writeups on daily.dev."}}]} ```