Check Point says North Korea’s Lazarus Group targeted defense and aerospace professionals using convincing fake job offers that led victims to download trojanized PDF software. The campaign used a Windows zero-day (now patched as CVE-2026-68820) to gain full control and hide from security tools, and relied heavily on hijacked legitimate websites and webmail servers to blend in. Confirmed targets were found in multiple countries including France, Germany, Brazil, and India.
This campaign, known as Operation Dream Job, targeted defense and aerospace professionals with fake job offers, including one referencing Lockheed Martin. Two infection paths were used. In one, victims downloaded an encrypted archive containing a legitimate signed PDF viewer bundled with a malicious DLL that displayed a convincing job description while quietly compromising the machine. In the other, victims were told to download a trojanized viewer called SecurityPDF from websites impersonating Enveil, a legitimate privacy technology company with no actual connection to the attack. Once installed, that modified viewer inspected any PDF opened through it for a hidden marker.
The attackers used a previously unknown Windows vulnerability, CVE-2026-68820, to gain full control of infected systems and reduce visibility for security tools. Rather than running their own infrastructure, they relayed commands through hijacked legitimate websites and webmail servers, including compromised Roundcube and WordPress installations. In at least one case, infrastructure belonging to a previously breached organization was reused to send phishing messages onward to new victims, making detection harder because the traffic looked like normal, trusted activity.
The pretext relied on something professionals in defense and aerospace fields are conditioned to respond to: recruiting outreach for relevant, high-value roles. Requiring a special viewer to read a job description added a layer of plausibility, since defense-related documents are sometimes handled with dedicated tools. Combined with a signed viewer in one chain and a convincing lookalike brand in the other, the technical and social elements reinforced each other.
Organizations in defense, aerospace, and government contracting should train staff to verify recruiter and company identity through known official channels before opening any attachment or installing any tool. Standard PDFs should never require a special viewer, and any request to do so should be treated as a red flag. Because this campaign relied on a real Windows zero-day, prioritizing fast patching for critical updates, including the August 2026 Patch Tuesday fix for CVE-2026-68820, remains an important complementary defense alongside awareness training.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers sent convincing fake job offers, including a Lockheed Martin job description, that asked targets to open a PDF viewer packaged with the file. That viewer contained a malicious DLL or was itself trojanized.
The zero-day, tracked as CVE-2026-68820, let attackers gain full control of infected computers and evade EDR visibility. Microsoft shipped a fix in the August 2026 Patch Tuesday update.
Attackers hijacked legitimate but compromised websites and webmail servers, including Roundcube and WordPress installations, to relay commands and make traffic blend in with normal activity.
Be wary of unsolicited recruiter outreach that requires installing a special PDF viewer or downloading software to read a job description, and verify recruiters through official channels.
You get an email: “Lockheed Martin job opportunity, open the attached description with the included PDF viewer.” Sounds flattering, right? This is Operation Dream Job from the Lazarus group: you download an encrypted archive, run their “PDF viewer,” and a hidden DLL pops up a real-looking Lockheed job while quietly exploiting a Windows zero-day, CVE-2026-68820. They even push a fake “SecurityPDF” download from sites impersonating Enveil, and route traffic through hijacked Roundcube and WordPress servers so it all looks legit in your logs. Aha moment: any recruiter who makes you install a special viewer is a no. Your move: stop, don’t run it, go to the official careers site or company HR contact and verify the job there.
Researchers describe a real, ongoing Lazarus-linked campaign where targets are lured with attractive job offers and tricked into downloading a PDF viewer and “job description” documents. Opening the files installs backdoors and, in at least one wave, attackers used a Windows zero-day to gain deep…
Researchers say the North Korea-linked Lazarus group ran “Operation Dream Job,” posing as recruiters and sending fake job offers to lure targets into downloading trojanized PDF tools and opening booby-trapped PDFs. The campaign focused largely on defense-related organizations and used both a…
Researchers tied North Korea’s Lazarus Group to a real-world campaign that approaches professionals with convincing fake recruiter outreach and job offers. Victims are tricked into opening a malicious PDF or installing a fake PDF viewer from lookalike websites, which then installs backdoors and can…
Check Point and Microsoft report North Korea’s Lazarus Group used a long-running “Dream Job” social engineering campaign to target defense-sector job seekers with fake employer sites and trojanized documents/software. Victims were lured into opening malicious PDFs or installing a modified PDF…
North Korea’s Lazarus group targeted defense and aerospace staff using fraudulent job offers and fake websites, then deployed malware that pulled down and ran a Windows zero-day exploit. The campaign also used websites impersonating Enveil to distribute a trojanized PDF viewer that delivered a new…
South Korean agencies warned that a state-backed hacking group is actively targeting citizens and businesses using job-themed phishing emails and “watering hole” attacks on legitimate websites. The phishing lures include fake job applicants sending resume links and impersonated recruiters sending…
