North Korean Hackers Use Infected Mobile Games to Spy on Ethnic Koreans in China

A North Korean hacking group known as APT37 has targeted ethnic Koreans in China’s Yanbian region using infected mobile games. The group hid malicious software called BirdCall inside popular Android apps. This latest campaign expands their long-running espionage efforts across Asia. APT37 has been active since 2012, primarily focusing on espionage against South Korea and neighbouring countries. In the past, they targeted academic experts and a news outlet specialising in North Korean affairs. Now, their attention has shifted to the Yanbian region—often called 'Third Korea'—home to many North Korean refugees and defectors.

The attack began when users downloaded a file from a compromised gaming website called Sqgame. The initial download appeared harmless, but a later update secretly installed BirdCall. Initially, security researchers believed BirdCall only affected Windows devices. However, an Android version was uncovered, revealing a broader threat.

Once installed, BirdCall gave APT37 full access to infected devices. The malware could take screenshots, record phone calls, and steal personal data. It also collected contact lists, text messages, call logs, media files, and even cryptographic private keys. Beyond data theft, the software turned devices into listening tools, using microphones to eavesdrop on conversations and surroundings. The discovery of BirdCall’s Android variant shows APT37’s growing ability to adapt its tactics. By hiding malware in mobile games, the group successfully infiltrated devices in a region with strong ties to North Korea. Security experts continue to monitor the situation as the hackers refine their methods for future campaigns.