ScarCruft (APT37), a North Korean state-sponsored threat group, compromised a Korean-language gaming platform to distribute BirdCall, a surveillance-grade Android malware targeting ethnic Koreans in China, including North Korean defectors. The malware collects audio recordings, contacts, SMS messages, location data, and files from infected devices. While the immediate target population is specific, the supply chain delivery method and the actor’s history of expanding operations warrant attention from any organization with Android device exposure or connections to Korean diaspora communities.