--- title: ScarCruft hackers push BirdCall Android malware via game... description: North Korean APT37 (ScarCruft) has deployed a new Android variant of its BirdCall backdoor through a trojanized game platform (sqgame[.]net) targeting... canonical: https://daily.dev/posts/scarcruft-hackers-push-birdcall-android-malware-via-game-platform-zq9iescqg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ScarCruft hackers push BirdCall Android malware via game platform | daily.dev og:description: North Korean APT37 (ScarCruft) has deployed a new Android variant of its BirdCall backdoor through a trojanized game platform (sqgame[.]net) targeting... og:url: https://daily.dev/posts/scarcruft-hackers-push-birdcall-android-malware-via-game-platform-zq9iescqg og:image: https://api.daily.dev/og/posts/zQ9ieSCQg.png og:image:alt: ScarCruft hackers push BirdCall Android malware via game platform og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ScarCruft hackers push BirdCall Android malware via game platform **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary North Korean APT37 (ScarCruft) has deployed a new Android variant of its BirdCall backdoor through a trojanized game platform (sqgame[.]net) targeting Korean-speaking users in China's Yanbian region. Developed around October 2024 with at least seven versions, the Android spyware collects contacts, call logs, SMS, device info, takes screenshots, records audio during specific hours, and exfiltrates files. The Windows infection chain uses a trojanized DLL to deploy RokRAT, which then installs BirdCall. ESET researchers note the Android version lacks some Windows capabilities like shell execution and browser data theft. Users are advised to only install apps from official marketplaces. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Kimsuky Spreads DocSwap Android Malware via QR Phishing Posing as Delivery App](https://daily.dev/posts/kimsuky-spreads-docswap-android-malware-via-qr-phishing-posing-as-delivery-app-d0m01dwpn) · The Hacker News · 0 upvotes · 0 comments - ['Flying Eagle' Full-Service Mobile RAT Builder Wings Across China](https://daily.dev/posts/flying-eagle-full-service-mobile-rat-builder-wings-across-china-8xku3rpjc) · Dark Reading · 1 upvotes · 0 comments - [Spyware disguised as emergency-alert app sent to Israelis](https://daily.dev/posts/spyware-disguised-as-emergency-alert-app-sent-to-israelis-jslad84mu) · The Register · 0 upvotes · 0 comments - [Frogblight banking Trojan targets Android users in Turkey](https://daily.dev/posts/frogblight-banking-trojan-targets-android-users-in-turkey-8txzdglvb) · Securelist · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber) [View this post on daily.dev](https://daily.dev/posts/scarcruft-hackers-push-birdcall-android-malware-via-game-platform-zq9iescqg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"ScarCruft hackers push BirdCall Android malware via game platform","url":"https://daily.dev/posts/scarcruft-hackers-push-birdcall-android-malware-via-game-platform-zq9iescqg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/scarcruft-hackers-push-birdcall-android-malware-via-game-platform-zq9iescqg"},"datePublished":"2026-05-05T09:05:16.974Z","dateModified":"2026-05-05T09:05:54.203Z","description":"North Korean APT37 (ScarCruft) has deployed a new Android variant of its BirdCall backdoor through a trojanized game platform (sqgame[.]net) targeting...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6d1549c9de5e1e3f5bc4bbf26928a7b5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6d1549c9de5e1e3f5bc4bbf26928a7b5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/scarcruft-hackers-push-birdcall-android-malware-via-game-platform-zq9iescqg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"ScarCruft hackers push BirdCall Android malware via game platform"}]} ```