Threat actors affiliated with DragonForce Malaysia, Lazarus Group, etc. exploit unauthorized nodes during MacOS software installations to gain persistence, exfiltrate data, and escalate privileges. Techniques observed include T1003 (Credential Dumping) to harvest keychain data, T1020 (Automated Exfiltration) over T1071 (Application Layer Protocol), and T1027 (Obfuscation) to conceal payloads. Persistence is achieved via T1053 (Scheduled Tasks) and T1543 (System Process Creation). Lateral movement is supported by T1046 (Network Discovery) and T1055 (Process Injection). Valid credentials (T1078) and remote services (T1133) enable long-term access. Proxy use (T1090) and tunneling (T1572) evade detection. Attackers hijack resources (T1496) and may deploy T1498 (DoS). Monitoring for unsigned installations, abnormal processes, and unusual traffic can detect this activity. Validating software sources and restricting network egress is recommended.