ScarCruft Hacks Gaming Platform, Deploys BirdCall Malware on Android & Windows

The North Korea-aligned state-sponsored hacking group ScarCruft has executed a supply chain espionage attack, compromising a video game platform. According to The Hacker News, the group trojanized platform components with a backdoor dubbed BirdCall, likely targeting ethnic Koreans residing in China.

This incident marks a significant expansion of ScarCruft’s operational scope. While previous iterations of BirdCall primarily focused on Windows users, The Hacker News reports that this supply chain compromise has enabled the deployment of the malware across both Android and Windows environments. This multi-platform capability allows for broader surveillance and data exfiltration.

This attack underscores the persistent threat of supply chain compromises, particularly when state-sponsored actors like ScarCruft are involved. By leveraging a trusted gaming platform, they bypass initial perimeter defenses, delivering sophisticated malware directly to user devices. Defenders must recognize that user trust in third-party software is a major vulnerability.