Logpresso attributes a September 2025 Lazarus campaign to malware disguised as Nvidia updates, arm64-fixer, and mac_camera.driver for Windows and macOS systems. Victims are prompted to install Node.js and run main.js, which contacts C2 infrastructure, downloads an encrypted Python payload, and decrypts it through string reversal, Base64 decoding, and zlib decompression. The payload collects host metadata, geolocation, Chromium browser credentials, and credit card data, then exfiltrates it and polls for remote commands after reboot. On Windows, drvupdate.exe is identified as a Nukesped component with Base64 plus XOR string decoding, a C2 handshake, and remote shell execution through cmd.exe.