S2W attributes BirdCall to the North Korea-backed ScarCruft group and analyzes an Android spyware sample created by repackaging the legitimate Zangi messenger application. BirdCall uses separate Zoho WorkDrive accounts for command delivery and exfiltration, collecting device details, contacts, call logs, SMS messages, directory listings, and selected files. It protects stolen data with custom packet and filename formats, zlib compression, AES-256-CBC encryption, XOR obfuscation, and RSA-2048 protection of dynamically generated master keys. Dormant code for messenger keylogging, screenshots, and microphone recording suggests the modular malware could gain additional capabilities or appear in other variants.