'Flying Eagle' Full-Service Mobile RAT Builder Wings Across China

A sophisticated, full-service mobile malware-as-a-service (MaaS) framework called ‘Flying Eagle’ has emerged from the Chinese cybercriminal underground, enabling criminals to build and deploy mobile malware campaigns with relative ease. The tool, initially circulated within closed circles, has now been widely distributed through Telegram channels, offering a range of features including screen capture, microphone access, and overlay injection into popular Chinese finance apps. A follow-up tool, ‘Night Dragon,’ offers enhanced capabilities such as live screen viewing and access to SMS messages, though it has seen less adoption.