Flying Eagle Android Trojan Turns Devices into Remote Surveillance Tools
Researchers from Hunt.io have dissected the Flying Eagle Android trojan, which is distributed under the guise of applications from the Bureau of Public Security. Victims are lured into installing an APK from counterfeit websites such as 110gongan[.]com and then granting it access to Accessibility Services. Once permissions are obtained, the smartphone effectively changes hands to the attackers.
The trojan records keystrokes, captures screenshots, displays phishing overlays on top of banking and government applications, reads SMS messages, and activates the camera and microphone. Through the Android API dispatchGesture, operators can remotely press buttons and fully control the device interface. Flying Eagle is not a single piece of malware but an entire surveillance factory. Attackers use a unified panel to assemble APKs with required phishing templates, manage compromised smartphones, and receive stolen data. One discovered server showed 46 victims, 29 of which remained online.
The builder can rename packages and classes, insert junk data to evade antivirus detection, and encrypt communication with the command server. Individual components carry descriptive names: LiveKeysStrok handles keylogging, ScreenCaps manages screen captures, and Webjector generates fake forms. Traces also link the platform to the SpyNote family. Over 30 days, researchers identified at least 170 active Flying Eagle servers, most located in Hong Kong, with additional nodes in the United States, Canada, Finland, Malaysia, and Japan.
Following the source code leak in February 2026, the trojan spread widely. On Telegram, builds are sold for approximately 2000 USDT, phishing templates are distributed, and stolen funds can be cashed out for a commission of up to 50 percent. A successor called Night Dragon is already in development, featuring a black screen mode, automatic hiding capabilities, and data theft targeting Alipay, WeChat, banking applications, and cryptocurrency wallets. The old eagle continues to fly while the new dragon has already been released to hunt.
Related articles
Octagon Android RAT Poses as Bahrain Emergency Alert App to Steal Credentials and Establish Persistent Surveillance
A remote access trojan named Octagon targets Android devices by masquerading as the official emergency alerts application from Bahrain. The infection begins when victims download the BH-Alert.apk file from phishing websites. The malware guides users through seven steps to grant dangerous permissions while using encrypted code hidden inside a font file extension to evade static analysis. It installs a secondary component called OctagonPanel and deploys mutual-monitoring surveillance services that restart each other if terminated. Additional persistence is achieved through boot receivers, a fake Android account, and scheduled synchronization tasks every 30 minutes. The trojan abuses the Accessibility Service to record unlock patterns, PINs, and passwords while also harvesting SMS messages, contacts, call logs, and screenshots. A criminal-controlled VPN allows interception and redirection of victim traffic.
Distributed Crawler Poses as Human Visitor to Evade Analytics and Ad Filters
A detailed investigation revealed a sophisticated distributed crawler that successfully mimicked legitimate human browsing behavior across multiple unrelated websites. The crawler generated realistic events in Google Analytics while avoiding ad script loading and resource chains that would confirm genuine user sessions. Server logs showed consistent patterns of fake search engine referrers, internal navigation with fabricated Referer headers, and selective requests limited mostly to images returning 404 errors. Analysts built a graph-based detection system that correlated events across sites to expose the coordinated activity despite individual requests appearing benign. The campaign rotated browser signatures and IP addresses frequently, making single-site rate limiting ineffective. The case demonstrates how modern crawlers can exploit Measurement Protocol and incomplete bot detection to consume server resources without contributing to revenue.
Comprehensive Collection of Malware Analysis and Development Books Released for Security Researchers
A detailed roundup of professional literature covering malware development, reverse engineering, and defensive analysis has been published. The selection includes resources focused on Windows, macOS, and Android platforms. Key titles address practical techniques for building and dissecting malicious software, evasion methods, and forensic investigation. Books such as MalDev Academy and Practical Malware Analysis provide hands-on training with real-world samples and laboratory exercises. Additional volumes explore macOS-specific threats and Android malware detection using machine learning. The compilation aims to support both red team practitioners and malware analysts in deepening their technical expertise.
Bots Now Form Over Half of Global Internet Traffic in 2025, Driving API Attacks and Business Metric Distortion
Automated clients generated more than 50% of analyzed internet traffic in 2025, with malicious bots responsible for 40% of the total volume. AI-enabled automation attacks increased 12.5 times year-over-year, while daily API attacks rose 113% according to Akamai data. Simple scripts still dominate volume at 59% of bot traffic, yet sophisticated botnets exceeding 4.5 million devices now distribute activity across residential proxies and compromised endpoints. Credential stuffing, scraping, and transaction abuse continue to target business logic rather than software vulnerabilities, distorting analytics, inflating infrastructure costs, and degrading user experience. Cloudflare reports that 20% of verified bot traffic now comes from AI crawlers, blurring lines between beneficial and harmful automation. Organizations must classify bots by intent, delegation, and business impact instead of relying on IP reputation or single signals such as User-Agent strings.