Researchers investigated a fake Android app posing as a Chinese public security bureau service and traced it to a broader criminal ecosystem using a leaked Android remote-access tool (RAT) framework called “Flying Eagle.” The tooling lets criminals build convincing look‑alike apps and then steal credentials through in-app “overlay” login prompts targeting payment, banking, and government service apps.
Researchers began by examining a fraudulent Android app impersonating a Chinese Provincial Public Security Bureau service. That investigation expanded into a much larger criminal ecosystem built around a leaked Android remote-access tool framework known as Flying Eagle. The framework includes an APK generation module that lets operators customize lured text, application names, icons, and command-and-control callback addresses before building a signed, convincing fake app.
Once installed, these apps use phishing overlays, fake login screens layered on top of real app interfaces, to capture credentials for financial, government service, and other targeted apps. Researchers mapped 170 active servers running the framework and identified two Telegram channels distributing modified versions of the stolen codebase, showing the scale and reach of this ecosystem.
The operation succeeded by combining authority impersonation with a technically capable delivery mechanism. Posing as a government public security service created urgency and trust that pushed victims to install software outside official app stores. Because the app was distributed as a direct APK download rather than through a vetted marketplace, victims had fewer signals to verify its legitimacy before installing it.
Once inside the device, the phishing overlay system made credential theft nearly seamless. Operators could deploy overlays with single-click shortcuts targeting specific apps like Alipay, WeChat, and major Chinese banks, reducing the friction needed to harvest sensitive login data.
Organizations and individuals can reduce risk from this type of campaign by treating unsolicited APK downloads as inherently risky, regardless of how official they appear. Employees should be trained to recognize that legitimate government services rarely require installing software through direct links rather than app stores.
Additional resistance-building steps include:
This case illustrates how a single impersonation lure can be a gateway into a much larger, well-resourced criminal infrastructure targeting financial and government service credentials at scale.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It was a fraudulent Android APK impersonating a Chinese Provincial Public Security Bureau service, used to lure victims into installing malware disguised as an official government app.
The malware displayed phishing overlays inside legitimate-looking apps, capturing login credentials for financial, government, and payment apps such as Alipay, WeChat, and major banks.
Flying Eagle is a leaked Android RAT builder that lets criminals generate custom lured APKs with chosen names, icons, and command-and-control addresses, and it has a successor called Night Dragon with added stealth features.
The app exploited trust in a government authority and was distributed as a direct APK download rather than through an official app store, making it harder for victims to verify legitimacy.
You see a site saying, “Download the official Provincial Public Security Bureau service app” for Android. Looks like a real police portal, right? Behind that APK could be the Flying Eagle Android RAT. Criminals use it to build fake police and welfare apps, complete with copied icons and text, all controlled from one of over 170 known servers. Once installed, it can pop up perfect-looking overlays on top of your banking or payment apps. You think you’re logging into your bank, but you’re handing credentials straight to their Night Dragon successor. Your move: if an 'official' app comes as an APK download link, skip it. Only install government or banking apps from the official app store with the verified publisher name.
Researchers describe RatHat, an Android trojan linked to China-based operators, that spreads via smishing, malvertising, and fake app stores to trick people into installing a malicious APK. Once installed, it pushes for Accessibility permissions and then uses that access to take deep control of the…
Microsoft reports that the EvilTokens phishing-as-a-service platform helped criminals compromise thousands of organizations by tricking users into completing a legitimate Microsoft “device code” login. The lure drives victims to enter a short code at microsoft.com/devicelogin, which unknowingly…
The report describes confirmed phishing activity targeting the financial sector, where victims were tricked into fake login pages via emails, links, or HTML attachments. The credentials entered were then exfiltrated to attackers through Telegram using APIs. The same report also highlights ongoing…
Rapid7 uncovered an active cryptocurrency fraud operation that combined phishing emails, follow-up phone calls, and counterfeit wallet apps to trick victims into handing over wallet recovery (seed) phrases. The attackers validated and enriched phone-number leads first, then used matching “support…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login…
