ScarCruft Hacks Gaming Platform to Deploy BirdCall Malware on Android and Windows
ScarCruft Hacks Gaming Platform to Deploy BirdCall Malware on Android and Windows
https://thehackernews.com/2026/05/scarcruft-hacks-gaming-platform-to.html
Publish Date: 2026-05-05 05:07:00
Source Domain: thehackernews.com
The North Korea-aligned state-sponsored hacking group known as ScarCruft has compromised a video game platform in a supply chain espionage attack, trojanizing its components with a backdoor called BirdCallto likely target ethnic Koreans residing in China.
While prior versions of the backdoor have primarily targeted Windows users only, the supply chain attack is assessed to have enabled the threat actors to also target Android devices, essentially turning it into a multi-platform threat.
According to ESET, the campaign has singled out sqgame[.]net, a gaming platform used by ethnic Koreans living in the Yanbian region in China bordering North Korea and Russia. It’s also known to act as a primary, high-risk transit point for North Korean defectors crossing the Tumen River.
Filip Jurčacko, senior malware researcher at ESET, told The Hacker News that the campaign was discovered in October 2025, adding the trojanized Android games are still available for download on the sqgame[.]net website.
The targeting of this platform is said to be a deliberate strategy given ScarCruft’s storied history of targeting North Korean defectors, human rights activists, and university professors.
“In the attack, probably ongoing since late 2024, ScarCruft compromised Windows and Android components of a video game platform dedicated to Yanbian-themed games, trojanizing them with a backdoor,” the Slovakian cybersecurity company said in a report shared with The Hacker News ahead of publication.
Windows versions of BirdCall, dubbed an advanced evolution of RokRAT, have been detected in the wild since 2021. Over the years, RokRAT has also been adapted to target macOS (CloudMensis) and Android (RambleOn), indicating that the malware family continues to be actively maintained by the threat actors.
BirdCall comes fitted with features typically present in a backdoor, enabling screenshot capture, keystroke logging, clipboard content theft, shell command execution, and data gathering. Like…
