A rigged game: compromises gaming platform in a supply-chain attack

North Korea-aligned APT group ScarCruft executed a multiplatform supply-chain attack targeting ethnic Koreans in China's Yanbian region, an area significant for North Korean refugees and defectors. Since late 2024, the group compromised a video gaming platform dedicated to Yanbian-themed games, trojanizing both Windows and Android components with the BirdCall backdoor. The Windows client received malicious updates leading to RokRAT and subsequently BirdCall deployment, while Android games were directly trojanized. This marks the first discovery of Android BirdCall, capable of comprehensive surveillance including data collection, screenshots, and voice recording. The campaign focuses on espionage against individuals of interest to the North Korean regime, particularly refugees and defectors.

• Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in AsiaMalware2026-10-29
• False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking AppsMalware2026-10-28
• New RemControl Android Banking Trojan Steals PINs Using AI-Built Phishing OverlaysMalware2026-09-24
• Striking gold: Inside the GoldDigger Android malwareMalware2026-08-12
• Operation Capsule Vault: RokRAT Attack Chain Analysis Using EMBED_PAYLOAD_v2Malware2026-07-12