Flying Eagle
151 hosts convicted as Flying Eagle remote-access trojan controllers: 148 still listed, 3 archived. First seen 2026-08-29.
About
An Android remote-access trojan built around a generator: the operator picks a name, an icon and a callback address, and it produces an APK. Its lures, aimed chiefly at Chinese users, have posed as government-service, adult-streaming, social-media and financial apps; on a phone it abuses the accessibility service, logs keystrokes and payment passwords, captures the screen and lays phishing overlays over financial apps. What is listed here is the operator's panel, the console that builds APKs and controls phones, never an infected handset; no phone is recorded and nothing on this page identifies a victim. The panel is built on a common admin template, so the scanner needs more than its page title to list one. Its source leaked in early 2026 and then circulated on Telegram, free and as patched builds offered for sale, so a listing says nothing about who runs any one panel.
Ports
Observed changes
Relabelled: 1 host earlier labelled Overlord. Only the most recent earlier label is kept.
Estimated moves of this family toward AS979 on 2026-10-06 (fewer than 10 hosts); toward AS16509 on 2026-10-06 (fewer than 10 hosts); toward AS37963 on 2026-10-06 (fewer than 10 hosts); toward AS45753 on 2026-10-06 (fewer than 10 hosts). These are the scanner’s estimates from passive search data, shown only where this archive also holds a host of this family. Showing the 4 newest of at least 9.
Detection packs
Rules for this hub's 148 still-listed hosts, across all 2 pages of the list, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts · page 1 of 2
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.