Symantec documents attackers abusing signed node.exe to run JavaScript payloads in intrusions since February.
North Korea-linked actors are using fake full-screen macOS updates to push ClickFix-style clipboard attacks.