Flying Eagle Android Trojan Turns Devices into Remote Surveillance Tools
Researchers at Hunt.io have analyzed the Flying Eagle Android trojan, which spreads via fake public security bureau apps hosted on counterfeit sites. Victims are tricked into installing the APK and granting Accessibility Services permissions, after which the malware effectively takes control of the device. It performs keylogging, screenshots, phishing overlays on banking and government apps, SMS interception, and remote camera and microphone activation. Operators use the dispatchGesture API to remotely control the interface and press buttons. The platform functions as a full surveillance factory with a unified panel for building customized APKs, managing infected devices, and collecting stolen data. After source code leaked in February 2026, builds are sold on Telegram for around 2000 USDT, with Night Dragon emerging as an enhanced successor targeting Alipay, WeChat, banking apps, and crypto wallets.
AntiMalwareJul 29, 2026Translated from Russian