MagicLine4NX is security-authentication software installed for certificate-based login to South Korean government, public-sector, and financial websites. DPRK actors exploited vulnerable installations through watering-hole pages to execute malicious code, remotely control victim computers, and move into internal networks; South Korean authorities reported compromises affecting about 50 organizations.