BirdCall Stages Collected Data in a Hidden AppData Archive

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•3•0•8

Detects a game-related process creating ZIP, 7z, or encrypted data containers in an inconspicuous AppData subdirectory. This behavior is indicative of data staging prior to exfiltration, often seen in supply chain attacks or targeted espionage.