Darktrace observed a recurring intrusion pattern in which ClickFix-style social engineering led macOS users into execution, followed by AppleScript or other native scripting and sustained outbound signaling. The use case is explicitly tied to activity Microsoft linked to DPRK, with Darktrace noting overlap with recent DPRK-nexus macOS intrusion reporting while assigning only moderate attribution confidence based on behavioral alignment. Affected devices made repeated HTTP POSTs and SSL connections to rare or IP-only endpoints including zoom.uswebob.us, check02id.com, and several IP addresses; one macOS case showed possible exfiltration before Autonomous Response blocked the destination. A related Windows case later showed PowerShell traffic to 83.136.208.246 on port 6783 using `/api/daemon`, reinforcing a cross-platform control-channel pattern.