Hunt.io

Hunt.io Exposes Suspected Chinese Cyber Espionage Operation Using Agentic LLMs Claude Code and DeepSeek

In July 2026 Hunt.io published research on a suspected Chinese cyber espionage campaign uncovered through an exposed directory on a Hong Kong server. The leak contained 2,431 files including victim source code, operation logs, web shells, exploitation scripts, scan results and phishing page clones. Researchers identified traces of Claude Code and DeepSeek-v4-pro working together, with Claude Code handling agentic tasks and session context while DeepSeek supported reasoning, script refinement and next-step selection. The infrastructure cluster, known as TencShell, showed overlapping SHA-256 HTTP headers, SSH host keys and TLS certificates across 13 IP addresses. Multiple initial access vectors were observed, including SQL injection against Taiwanese and Thai government targets plus exposure of Supabase and Azure secrets. The report also references a parallel Anthropic disclosure on GTG-1002, another Chinese state-linked operation that used Claude Code for 80-90 percent of tactical work.

Flying Eagle Android Trojan Turns Devices into Remote Surveillance Tools

Researchers at Hunt.io have analyzed the Flying Eagle Android trojan, which spreads via fake public security bureau apps hosted on counterfeit sites. Victims are tricked into installing the APK and granting Accessibility Services permissions, after which the malware effectively takes control of the device. It performs keylogging, screenshots, phishing overlays on banking and government apps, SMS interception, and remote camera and microphone activation. Operators use the dispatchGesture API to remotely control the interface and press buttons. The platform functions as a full surveillance factory with a unified panel for building customized APKs, managing infected devices, and collecting stolen data. After source code leaked in February 2026, builds are sold on Telegram for around 2000 USDT, with Night Dragon emerging as an enhanced successor targeting Alipay, WeChat, banking apps, and crypto wallets.