Check Point and Microsoft report North Korea’s Lazarus Group used a long-running “Dream Job” social engineering campaign to target defense-sector job seekers with fake employer sites and trojanized documents/software. Victims were lured into opening malicious PDFs or installing a modified PDF viewer, which then delivered malware and supported follow-on exploitation of a Windows zero-day.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Dream jobs impersonating Lockheed Martin or Enveil pop up in your inbox or top of Google. Looks legit, right? This is Lazarus’ “Dream Job” scam. They built fake Enveil career sites and push them up search results, then hand you a malicious PDF or a booby‑trapped viewer called SecurityPDF that runs their Troy backdoor. Here’s the tell: a high‑profile offer that suddenly needs you to install “SecurityPDF” or use some special viewer just to read an application. Real recruiters don’t make you install random tools for a PDF. If any job process asks you to install special software or a new PDF viewer, stop. Don’t install it, report it to Security immediately so we can check it out.
Researchers say the North Korea-linked Lazarus group ran “Operation Dream Job,” posing as recruiters and sending fake job offers to lure targets into downloading trojanized PDF tools and opening booby-trapped PDFs. The campaign focused largely on defense-related organizations and used both a…
Check Point says North Korea’s Lazarus Group targeted defense and aerospace professionals using convincing fake job offers that led victims to download trojanized PDF software. The campaign used a Windows zero-day (now patched as CVE-2026-68820) to gain full control and hide from security tools,…
Researchers tied North Korea’s Lazarus Group to a real-world campaign that approaches professionals with convincing fake recruiter outreach and job offers. Victims are tricked into opening a malicious PDF or installing a fake PDF viewer from lookalike websites, which then installs backdoors and can…
Researchers describe a real, ongoing Lazarus-linked campaign where targets are lured with attractive job offers and tricked into downloading a PDF viewer and “job description” documents. Opening the files installs backdoors and, in at least one wave, attackers used a Windows zero-day to gain deep…
Microsoft says Russian-linked threat actors compromised hotel and conference guest Wi‑Fi “captive portal” networks to redirect travelers to fake Microsoft 365 sign-in pages, device-code phishing, or fake update pages. The goal was to steal cloud credentials (including Entra ID device codes) and…
South Korean agencies warned that a state-backed hacking group is actively targeting citizens and businesses using job-themed phishing emails and “watering hole” attacks on legitimate websites. The phishing lures include fake job applicants sending resume links and impersonated recruiters sending…
