MEDIUMMalware
Global

Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates

·Source: The Hacker News

Updated:

Executive Summary

Source code for the Flying Eagle Android remote access trojan (RAT) framework is circulating through criminal Telegram channels. Hunt.io and independent researcher NetAskari traced matching control panels and certificates to 170 internet servers. They linked the framework to a fake "公安一网通办" Public Security service application targeting Android users in China. The kit supports payment-password

Analysis

Source code for the Flying Eagle Android remote access trojan (RAT) framework is circulating through criminal Telegram channels. Hunt.io and independent researcher NetAskari traced matching control panels and certificates to 170 internet servers. They linked the framework to a fake "公安一网通办" Public Security service application targeting Android users in China. The kit supports payment-password

Indicators of Compromise (1)

Domain (1)
Hunt.io
VirusTotalURLhaus
Source Attribution

Originally published by The Hacker News on Jul 29, 2026.

Related Threats

MEDIUMMalware

DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware

Threat actors with ties to North Korea have been attributed to a sophisticated macOS malvertising campaign that involves redirecting users to fake web pages displaying a full-screen non-existent update sequence to deliver malware as part of a new iteration of the long-running Contagious Interview campaign. The defining aspect of the attack is that bogus macOS software update screen stealthily

The Hacker News
MEDIUMMalware

Cryptohack Roundup: Triple-A, Verus-Ethereum Bridge Exploits

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/cryptohack-roundup-triple-a-verus-ethereum-bridge-exploits-image_small-1-a-32374.jpg" align=right hspace=4><b>Also: Hackers Use SparkKitty Malware to Steal Seed Phrases</b><br>This week, Triple-A wallet was compromised and Verus-Ethereum Bridge exploited, hackers used SparkKitty malware to steal seed phrases, fake IRS letters targ

Bank Info Security
MEDIUMMalware

After the Break-In: What Attackers Do Once They're Already Inside

Attackers rarely stop after gaining initial access. Huntress analyzes a real-world intrusion to show how threat actors establish persistence, disable defenses, and reshape compromised systems, and why defenders must investigate the original entry point rather than simply remove the malware. [...]

BleepingComputer