Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates

Source code for the Flying Eagle Android remote access trojan (RAT) framework is circulating through criminal Telegram channels. Hunt.io and independent researcher NetAskari traced matching control panels and certificates to 170 internet servers. They linked the framework to a fake "公安一网通办" Public Security service application targeting Android users in China. The kit supports payment-password

Report facts: The article describes the Flying Eagle Android remote access trojan framework, whose full source code and turnkey Docker deployment (web stack, APK builder, phishing templates, default TLS cert) are circulating on criminal Telegram channels, and whose infrastructure fingerprints have been mapped to 170 servers hosting a fake Chinese Public Security service app used to steal payment data and remotely control Android devices.[2][1] The kit supports advanced surveillance and fraud capabilities including payment-password and keystroke capture, screen recording, camera access, and phishing for financial and government applications.[2] RealGround analysis: While Flying Eagle itself is not an AI system, its leaked, easily reusable framework and phishing tooling increase the likelihood that similar infrastructures will integrate AI-powered elements (e.g., automated targeting, content generation, or evasion), making it a relevant pattern for monitoring "malicious AI use" ecosystems. Continuous AI Red Teaming can help organizations simulate how such RAT/phishing frameworks could be augmented by AI agents, test their controls against evolving attacker tooling, and ensure that an