North Korean Hackers Use Android Games to Spy on Ethnic Koreans in China

A North Korean hacking group has been using a backdoor called BirdCall to spy on mobile users. The malware was hidden inside popular Android games from developer Sqgame. Ethnic Koreans in China’s Yanbian region became the main targets of this cyberattack. APT37, a hacking group linked to North Korea, has been active since 2012. Its focus has long been espionage, particularly against South Korea and other Asian nations. In this latest campaign, the group turned its attention to the Yanbian region, often called the 'Third Korea' due to its large ethnic Korean population, including refugees and defectors.

The attack began with a seemingly harmless file downloaded from Sqgame’s games. The malware only activated after a later, compromised update. This method allowed BirdCall to avoid early detection. BirdCall was first spotted in 2021 by South Korean cybersecurity firm AhnLab, which identified a Windows version. Later, researchers found an Android variant as well. Once installed, the backdoor gave APT37 full access to infected devices. It could take screenshots, record calls, and steal personal data like contacts, SMS messages, call logs, and even private encryption keys. ESET researchers reached out to Sqgame in December 2025 to warn them about the breach. However, the company never responded.

The BirdCall malware allowed APT37 to gather sensitive information from victims in Yanbian. The attack highlights how legitimate apps can be turned into spy tools through compromised updates. Security researchers continue to monitor the situation, but no official response has been made by Sqgame.