Researchers describe a real, ongoing Lazarus-linked campaign where targets are lured with attractive job offers and tricked into downloading a PDF viewer and “job description” documents. Opening the files installs backdoors and, in at least one wave, attackers used a Windows zero-day to gain deep control and reduce security visibility. The campaign heavily targets defense, aerospace, and aviation organizations, especially in Europe and India.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email from a recruiter: “Job opportunity at a well-known defense company, see attached job description.” Sounds legit, right? This is Operation Dream Job. The ZIP hides a “PDF viewer” EXE, a fake PDF, and a malicious DLL. You run the viewer, a decoy job description opens, and in the background malware installs using a Windows zero-day. In another wave, they impersonate Enveil, push a trojanized “SecurityPDF” from a lookalike website, and any PDF with a hidden marker triggers payload execution every time you open it. Here’s the move: if a job email or vendor says “download our special viewer” to open a PDF, stop. Don’t run it, forward the message to security and ask them to check it.
Check Point says North Korea’s Lazarus Group targeted defense and aerospace professionals using convincing fake job offers that led victims to download trojanized PDF software. The campaign used a Windows zero-day (now patched as CVE-2026-68820) to gain full control and hide from security tools,…
Researchers say the North Korea-linked Lazarus group ran “Operation Dream Job,” posing as recruiters and sending fake job offers to lure targets into downloading trojanized PDF tools and opening booby-trapped PDFs. The campaign focused largely on defense-related organizations and used both a…
Researchers tied North Korea’s Lazarus Group to a real-world campaign that approaches professionals with convincing fake recruiter outreach and job offers. Victims are tricked into opening a malicious PDF or installing a fake PDF viewer from lookalike websites, which then installs backdoors and can…
Check Point and Microsoft report North Korea’s Lazarus Group used a long-running “Dream Job” social engineering campaign to target defense-sector job seekers with fake employer sites and trojanized documents/software. Victims were lured into opening malicious PDFs or installing a modified PDF…
North Korea-linked Lazarus Group ran a “Dream Job” campaign targeting people applying for defense and aerospace jobs by posing as recruiters on LinkedIn and other platforms. Victims were sent malicious PDF files; opening them enabled a backdoor and then an exploit for a Windows zero-day…
North Korea’s Lazarus group targeted defense and aerospace staff using fraudulent job offers and fake websites, then deployed malware that pulled down and ran a Windows zero-day exploit. The campaign also used websites impersonating Enveil to distribute a trojanized PDF viewer that delivered a new…
