Servers matched to Flying Eagle infrastructure: 170 (Source: Hunt.io and NetAskari research, reported by The Hacker News (July 2026))
A Leak Turns One Campaign Into a Template
Researchers at Hunt.io, working with independent analyst NetAskari, spent weeks tracing a single Android surveillance campaign back to its source. What they found was not one operator running one piece of malware. It was a packaged framework — control panels, certificates, and deployment scripts — reused across dozens of unrelated servers, evidence that the same toolkit had been picked up and redeployed by multiple groups after its source code began circulating on criminal Telegram channels.
What's Actually Inside the Archive
The framework, called Flying Eagle, is built to construct and control weaponized Android applications. Its complete source landed on Telegram as a 388 MB archive named "Chinese Dragon.zip." Anyone who downloaded it received a working operations center, not just a trojan: Docker deployment scripts, an nginx web server, a PHP and MySQL backend, a Node.js WebSocket server for live device control, Android build tooling, and a library of ready-made phishing page templates.
How the Fingerprint Was Built
Hunt.io and NetAskari identified most of the 170 servers through a distinctive combination of signals — a control-panel page titled "AdminPro," a consistent HTTPS redirect pattern, and matching HTTP response headers — the same category of passive fingerprinting used to identify web software at scale from the outside. A smaller set surfaced through shared default TLS certificates. The researchers were explicit that 170 is a floor, not a ceiling: infrastructure that doesn't share those specific fingerprints simply wasn't counted.
Borrowing the Government's Name
One deployment illustrates the intent behind the kit. A fraudulent Android application impersonating "Public Security One-Stop Service" — a real government portal referenced by name in China — was distributed from a lookalike domain, 110gongan[.]com. The app borrowed the trust a government-service brand carries, then used that trust to harvest payment credentials, log keystrokes, record the screen, and access the camera. Phishing prompts inside the app were built to resemble financial, adult-content, and government-service applications, widening what operators could plausibly ask a victim to hand over. A related kit called Night Dragon, introduced on Telegram in June 2026, showed an exposed panel with dozens of devices reporting in — a live snapshot of how quickly a leaked framework moves from archive to active operation.
The Stack Doesn't Care Who's Running It
For organizations that file this under "mobile problem," the useful detail is the delivery layer. Flying Eagle's operators didn't write a novel content-management system or invent a new hosting pattern — they reached for nginx, PHP, and MySQL, the same combination that runs a large share of the web's detected, legitimate frameworks. That's not incidental; it's a rational choice. The stack is inexpensive, well-documented, and fast to stand up, which is exactly why it dominates legitimate deployments too. A leaked archive that packages that stack alongside a working phishing template turns building a convincing fake government portal from a specialized skill into a checklist.
The fingerprinting method that cracked this case — matching page titles, redirect behavior, and response headers across servers — is the same passive technique used to identify what software any given website is running, at scale, without needing access behind the login. Applied by researchers, it traces criminal infrastructure. Applied by anyone else, it surfaces exposed or repurposed web software just as easily. For budget-signers, the point isn't specific to Android — it's that the visible surface of any web-facing deployment, criminal or corporate, is more discoverable from the outside than most assume.
