ScarCruft Hacks Gaming Platform to Deploy BirdCall Malware on Android and Windows

Back Thehackernews

ScarCruft Hacks Gaming Platform to Deploy BirdCall Malware on Android and Windows

Thehackernews •[email protected] (The Hacker News) • May 5, 2026

Share: View original

Learn how to stop patient zero attacks before they bypass detection and compromise your systems at entry points.

Learn how to validate real attack paths and reduce exploitable risk with continuous agentic security validation.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ScarCruft's Supply-Chain Attack Targets Yanbian Gaming Platform with BirdCall Malware ESET researchers reported a supply-chain attack by the North Korean APT group ScarCruft, targeting a gaming platform in the Yanbian region of China. The attack, ongoing since late 2024, involved trojanizing both Windows and Android components of the platform, sqgame[.]net, which hosts traditional Yanbian-themed games. The Android variant of the backdoor, named BirdCall, was developed over several months, with at least seven versions identified from October 2024 to June 2025. The malware is designed to gather intelligence on users, particularly targeting ethnic Koreans and North Korean defectors. The Windows version of BirdCall has been known since 2021 and includes capabilities such as keystroke logging and file exfiltration. The attack's command-and-control traffic was routed through cloud storage services, with ESET notifying the platform of the compromise in December 2025, but no response was received. The malicious APKs remain available for download on the site. 9 sources 76

Extracted Entities

APT Groups (1)

Attack Types (1)

Malware (1)

Platforms (2)

Android Windows