ScarCruft Hacks Gaming Platform to Deploy BirdCall Malware on Android and Windows

The North Korean-aligned hacking group ScarCruft compromised a gaming platform serving ethnic Koreans in China to distribute BirdCall, an advanced multi-platform backdoor malware targeting both Android and Windows devices.

• •BirdCall is an evolved version of RokRAT with capabilities including screenshot capture, keystroke logging, clipboard theft, and shell command execution
• •The malware uses legitimate cloud services like Dropbox, pCloud, Yandex Disk, and Zoho WorkDrive for command-and-control communications
• •The Android variant collects contacts, SMS messages, call logs, media files, documents, screenshots, and ambient audio
• •The supply chain attack on sqgame[.]net involved trojanizing Android APKs, with the first Android version detected in October 2024
• •