Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon

A leaked Android RAT/C2 platform called Flying Eagle (飞鹰) — provided as a Docker/XAMPP build that generates obfuscated, credential-stealing APKs with phishing overlays — was distributed via Telegram channels (Yx科技 and SQLRCE0). Hunt.io linked the builder to ~170 servers through TLS/certificate and panel fingerprints, recovered IOCs (IPs, domains, certificates, hashes), and observed active operational support, cash-out services, and a likely successor project (Night Dragon), indicating an active financially motivated mobile malware ecosystem targeting primarily Chinese users.