Proofpoint observed TA427, overlapping with Kimsuky or Emerald Sleet, adding ClickFix social engineering to its North Korea affairs targeting in January and February 2025. Operators used spoofed meeting-request conversations, benign and malicious PDF lures, attacker-controlled secure-drive pages, and pop-up instructions that pushed victims to paste and run PowerShell commands. The DPRK-linked chain fetched remote PowerShell, showed a decoy questionnaire about Northeast Asia nuclear policy, and in one case continued through VBS and batch scripts to QuasarRAT. The report frames ClickFix as a cybercrime technique being adopted by state-sponsored groups, with TA427 replacing parts of its usual execution chain rather than changing its target set.