Chinese cybercriminals have been using a sophisticated malware-as-a-service (MaaS) framework called “Flying Eagle” to spread full-service mobile malware across the country. This premium-grade offering has been used by multiple threat groups to steal money from popular finance apps, with victims downloading fake apps that promised citizens “one-stop handling” of public safety issues online.
The discovery of Flying Eagle was made possible after China’s National Cybersecurity Reporting Center issued a warning on WeChat to the general public about a campaign masquerading as provincial public security services. The warning listed two IP addresses associated with the campaign, which led independent researchers NetAskari and hunt.io down a rabbit hole to uncover the substantial cybercriminal ecosystem built around Flying Eagle.
At its core, Flying Eagle is an all-in-one MaaS builder that provides everything an ordinary hacker needs to build their own easy mobile malware campaign. Instead of being distributed as files on a server, Flying Eagle is packaged as a complete Docker deployment, making it accessible and user-friendly for those who don’t have extensive technical expertise. Users get their own goodie bag with a Web server, WebSocket server, PHP, and MySQL, as well as Android Package Kit (APK) and software development kit (SDK) build tools.
The flexibility and ease of use of modern MaaS offerings like Flying Eagle are staggering. According to NetAskari, “Graphical user interfaces (GUIs), clear structures and workflows, templates, ready-to-deploy frameworks… it doesn’t really require a lot of skill anymore to set up modest systems to launch, breach, and extract data from average hardened devices.” This level of sophistication is clearly tailored towards ordinary criminals rather than sophisticated hackers.
When researchers stood up a test instance of Flying Eagle, they found that the developers had included various features for helping users evade static detection out of the box. For example, it conceals names of classes in its code and ensures that each new sample of malware is unique by replacing its hardcoded package name with a randomly generated but seemingly legitimate name.
Flying Eagle samples can steal a wide variety of data off mobile devices, including payment credentials and screengrabs. They support keylogging and camera access, and can abuse accessibility services to escalate privileges, as well as inject overlays into government, pornographic, and financial services apps.
The implications of Flying Eagle are significant, highlighting the growing sophistication and accessibility of cybercrime tools. As NetAskari notes, “Docker makes a lot of sense” for cybercriminals, as it keeps things clean and can be deployed on almost any remote server with little investment in time or adoption.
For security-conscious individuals, this is a stark reminder to exercise caution when downloading apps from untrusted sources. Be wary of phishing templates that mimic popular services, such as TikTok or financial apps, and never give out sensitive information unless you’re sure the app is legitimate. By staying vigilant and informed about the latest cyber threats, we can all play a role in keeping our digital lives secure.
Source: Dark Reading — 2026-07-30