Flying Eagle Android Trojan Turns Devices into Remote Surveillance Tools
Researchers from Hunt.io have dissected the Flying Eagle Android trojan, which is distributed under the guise of applications from the Bureau of Public Security. Victims are lured into installing an APK from counterfeit websites such as 110gongan[.]com and then granting it access to Accessibility Services. Once permissions are obtained, the smartphone effectively changes hands to the attackers.
The trojan records keystrokes, captures screenshots, displays phishing overlays on top of banking and government applications, reads SMS messages, and activates the camera and microphone. Through the Android API dispatchGesture, operators can remotely press buttons and fully control the device interface. Flying Eagle is not a single piece of malware but an entire surveillance factory. Attackers use a unified panel to assemble APKs with required phishing templates, manage compromised smartphones, and receive stolen data. One discovered server showed 46 victims, 29 of which remained online.
The builder can rename packages and classes, insert junk data to evade antivirus detection, and encrypt communication with the command server. Individual components carry descriptive names: LiveKeysStrok handles keylogging, ScreenCaps manages screen captures, and Webjector generates fake forms. Traces also link the platform to the SpyNote family. Over 30 days, researchers identified at least 170 active Flying Eagle servers, most located in Hong Kong, with additional nodes in the United States, Canada, Finland, Malaysia, and Japan.
Following the source code leak in February 2026, the trojan spread widely. On Telegram, builds are sold for approximately 2000 USDT, phishing templates are distributed, and stolen funds can be cashed out for a commission of up to 50 percent. A successor called Night Dragon is already in development, featuring a black screen mode, automatic hiding capabilities, and data theft targeting Alipay, WeChat, banking applications, and cryptocurrency wallets. The old eagle continues to fly while the new dragon has already been released to hunt.
Related articles
Octagon Malware-as-a-Service Platform Targets Android Banking Apps and Crypto Wallets for $1400 Monthly Subscription
Researchers at iVerify have uncovered the previously unknown Octagon platform, a malware-as-a-service offering sold by a Russian-speaking actor under the handle AndroidKitKat. The service first appeared on underground forums on June 1, 2026, with version 1.2 released by June 29, providing a ready-made control panel for account takeovers across banks, crypto exchanges, messengers, and wallets. Infection starts with a disguised APK that requests Accessibility Services permissions, after which the trojan can read UI elements, simulate taps, launch apps, and overlay phishing screens on services such as Trust Wallet, Binance, and MEXC. The malware also intercepts SMS one-time codes, spoofs the system lock screen to steal PINs or patterns, and supports VNC-style remote control while operating on the victim’s own device to evade anti-fraud systems. Three related builds—Octagon, Lifted Dreams, and BahrDate—were identified, with one variant displaying a visual novel to distract users while the spyware runs in the background. The campaign underscores the growing threat of sophisticated Android remote-access trojans sold on a subscription basis.
BTMOB Platform Turns Android Banking Trojan into Customizable Fraud Campaign Constructor
Researchers at QuimeraX have uncovered BTMOB, a platform that evolved from a banking trojan into a full-featured builder for fraudulent Android campaigns. The service allows clients without development skills to select an app name, icon, command-and-control server, permissions, and social-engineering lure, after which the system automatically compiles a ready-to-use APK. The package includes an Android payload, dropper, VB.NET control panel, PHP and MySQL backend, and build tools that enable rapid production of localized copies of streaming services, banking protection modules, parcel trackers, and social networks. One BTMOB 2.5 variant was distributed via a phishing site mimicking the Turkish iNat TV service, while Brazilian operators created fake Google Play pages impersonating Nubank, TikTok, and the government portal Gov.BR. After installation, the trojan requests accessibility permissions and, once granted, grants operators near-complete device control including screen viewing, keystroke capture, audio recording, and real-time WebSocket interaction that lets attackers perform actions directly on the victim’s device. Analysts link BTMOB to the SpySolr family and earlier commercial RATs CypherRAT and CraxsRAT, which had already attracted more than 100 licensees.
Dysphoria Botnet Compromises Nearly 300,000 Devices for DDoS Attacks and Residential Proxy Services
The Dysphoria botnet has infected approximately 296,000 devices, including routers, IP cameras, gateways, and embedded Linux systems. Researchers first observed the threat in the first quarter of 2026, noting rapid evolution from the jackskid and fbot families. The infrastructure is primarily used for DDoS attacks but has expanded to offer residential proxy capabilities. Infection occurs through brute-force attacks on Telnet and SSH services with weak credentials, as well as known remote code execution vulnerabilities in IoT equipment. A key technical advancement involves the use of Ethereum and Solana blockchain domains for command-and-control infrastructure, making takedowns significantly harder. Compromised devices can also function as relays by leveraging UPnP to expose ports and hide criminal traffic origins. Operators advertise attack capacity of up to 4 Tbps and sell DDoS services in structured commercial packages targeting internet services and gaming platforms worldwide.
TRON, Aptos and BSC in One Infection Chain: JavaScript Loader Linked to ChainVeil Campaign
Researchers at Checkmarx examined the ChainVeil campaign that used npm packages to distribute multi-stage JavaScript loaders. A newly discovered sample appeared in a GitHub repository recommended by an AI agent, where the file navigation.js contained an obfuscated loader that matched the campaign's techniques. The loader retrieves encrypted payloads from TRON, falls back to Aptos, and then uses the extracted data as a BSC transaction identifier to fetch the next stage. C2 infrastructure and final RAT functionality aligned exactly with previously published indicators, except for the campaign identifier A9-0554-3 instead of the A6-* markers seen in npm samples. Git history showed the malicious code was inserted via a merge commit on 29 March 2026, months before the first known npm packages appeared in May. The findings indicate that npm was never the only distribution channel for ChainVeil and that the campaign's blockchain-based delivery mechanism has been active since at least early 2025.