Flying Eagle is an Android RAT (Remote Access Trojan) builder and control framework whose source code is circulating on criminal Telegram channels. The code was distributed as a 388 MB archive named '中国龙.zip' (Chinese Dragon). It contains a full Docker deployment stack including nginx, PHP, MySQL, a Node.js WebSocket server, Android build tools, phishing templates, and a default TLS certificate. The panel allows operators to customize app name, icon, lure text, and C2 address, then generates a signed APK from one of two templates. The builder randomizes package and class names, encrypts embedded C2 URLs using AES-128-CBC, and adds 2.8–3.5 MB of low-entropy JSON padding designed to mimic legitimate SDK configuration data. Samples analyzed were detected as SpyNote and used Android accessibility services for privilege escalation and gesture injection. Capabilities include payment-password and keystroke capture, screen recording, camera access, and phishing prompts targeting financial, adult-content, and government-service applications. Hunt.io identified 158 servers via AdminPro page title, HTTPS redirect behavior, and matching response headers, and 12 more via a default certificate bundled with Flying Eagle, totaling 170 servers. The framework was used to distribute a fake '公安一网通办' (Public Security) app targeting Android users in China. A related but independent Android control kit called Night Dragon was introduced by Telegram channel SQLRCE0 on June 23, 2026, with two associated servers found and an exposed panel listing 46 devices as online and 29 actively connected. Night Dragon appears to be a second version in development as of July 12, 2026, and is financially motivated crimeware unrelated to the 2011 McAfee Night Dragon espionage campaign.