Imagine you get a message. It looks official. It says your local public safety office now has a slick new app “one-stop” service, no more queuing at the counter. You download it. You feel modern. You feel efficient. Three weeks later, your bank balance tells a different story. That’s not a hypothetical. That’s what just happened to thousands of people in China, and the tool behind it has a name that sounds more like a drone startup than a criminal enterprise: Flying Eagle.
Flying Eagle is a mobile malware-as-a-service (MaaS) and Remote Access Trojan (RAT) framework targeting Android users. Its source code and database logs leaked in early 2026, leading to widespread distribution and modified variants across criminal Telegram channels. In June, China’s National Cybersecurity Reporting Center put out a public warning about criminals masquerading as provincial public security services, spreading a fake app promising citizens “one-stop handling” of public safety issues online, that secretly infected devices with information-stealing malware.
Researchers followed the trail from that warning and found something bigger: a full malware-as-a-service ecosystem built around a sophisticated builder called Flying Eagle. Flying Eagle isn’t some clunky script kiddie toolkit. It’s distributed as a complete Docker deployment every buyer gets their own web server, WebSocket server, PHP, and MySQL, packaged and ready to run. It even ships with Android build tools, Java 11, a default TLS certificate, and phishing templates mimicking TikTok, adult services, financial apps, and public welfare projects.
This is DevOps, but for crime. Someone productized cybercrime the same way SaaS companies productized everything else click, deploy, profit. According to Dark reading, One researcher put it plainly to modern kits like this are so modular and GUI-driven that launching, breaching, and extracting data from hardened devices barely requires skill anymore. It’s built for ordinary criminals, not elite hackers. That’s the scary bit the barrier to entry just collapsed.
The malware itself is thorough. It steals payment credentials and screenshots, logs keystrokes, accesses the camera, abuses accessibility permissions to escalate privileges, and injects fake overlays onto banking and government apps. And when the Chinese government tried to shut the door, the crew behind it released a successor called “Night Dragon” one that can hijack live screen views, microphone audio, camera feeds, SMS, and photo galleries, and targets apps from AliPay to the Agricultural Bank of China, China Construction Bank, and ICBC directly.
Same week the warning dropped. Five days later, the replacement was live. That’s not a criminal gang, that’s a company with a release cycle. This may seem a foreign story but Why Should this Matter for Africa?
This is because Africa is the mobile money capital of the planet. M-Pesa in Kenya. MTN MoMo across a dozen countries. Orange Money right here in Cameroon. Nigeria’s fintech scene alone processes billions of dollars a year through apps that look and feel exactly like the “one-stop government service” app that just got weaponized in China.
We are, structurally, the perfect target for a Flying Eagle-style kit. Overlay attacks on banking apps don’t care what language your UI is in. Fake “government portal” apps work even better here, frankly, because in several African markets, digital government services are new enough that people genuinely don’t know what legitimate looks like yet.
And here’s the infrastructure gap I keep hammering on: most African telecoms and financial regulators are still building basic digital ID and KYC rails. Meanwhile, criminal groups are running Docker-packaged malware factories with better DevOps practices than half the fintechs I’ve seen deploy code. We’re playing checkers. They’re playing SaaS.
Now, before this turns into a panic piece, let’s be real about scale. Flying Eagle, as reported, is still a China-specific ecosystem targeting Chinese-language phishing templates and Chinese banking apps by name. There’s no confirmed evidence yet of it or a direct clone actively targeting African markets.
But “no evidence yet” is doing a lot of quiet work in that sentence. MaaS kits get cloned, rebranded, and resold across underground markets constantly. The overlay technique, the Docker packaging, the fake-government-app playbook none of that is China-specific know-how. It’s a business model, and business models travel.
Mobile malware-as-a-service is going to hit African fintech and mobile money users before most of our regulators even finish drafting the policy memo about it. I’ll say it plainly: within the next 18 months, expect at least one major African mobile money platform to publicly disclose an overlay-attack fraud wave lifted straight from this Docker-in-a-box playbook. The infrastructure gap isn’t theoretical anymore it’s a countdown clock.