North Korea’s Lazarus group targeted defense and aerospace staff using fraudulent job offers and fake websites, then deployed malware that pulled down and ran a Windows zero-day exploit. The campaign also used websites impersonating Enveil to distribute a trojanized PDF viewer that delivered a new backdoor.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get this in your work inbox: “Hi, I’m reaching out with a job opportunity…” for drones and surveillance roles. Looks flattering, right? This is Lazarus’s “Operation Dream Job.” They send you fake offers, then push you to open crafted documents or install a special PDF viewer from a site that looks like Enveil. That viewer quietly pulls a Windows zero-day exploit, CVE-2026-68820. Here’s the trap: unsolicited recruiter email to your work address, pressure to open their crafted docs, and “you must install our viewer” from a search result that magically ranks first for a niche vendor like Enveil. That combo is the tell. If a recruiter or vendor email wants you to open special docs or install a viewer, stop and forward it to Security, let them open that ‘dream job’ first.
Check Point says North Korea’s Lazarus Group targeted defense and aerospace professionals using convincing fake job offers that led victims to download trojanized PDF software. The campaign used a Windows zero-day (now patched as CVE-2026-68820) to gain full control and hide from security tools,…
Researchers describe a real, ongoing Lazarus-linked campaign where targets are lured with attractive job offers and tricked into downloading a PDF viewer and “job description” documents. Opening the files installs backdoors and, in at least one wave, attackers used a Windows zero-day to gain deep…
Researchers say the North Korea-linked Lazarus group ran “Operation Dream Job,” posing as recruiters and sending fake job offers to lure targets into downloading trojanized PDF tools and opening booby-trapped PDFs. The campaign focused largely on defense-related organizations and used both a…
Researchers say a Chinese-speaking cybercrime group compromised Brazilian government and education websites and used them as “trusted” entry points to quietly redirect visitors to attacker-run phishing pages. The fake pages impersonated well-known app stores (Google Play, Microsoft Store, Amazon)…
This threat trend report describes multiple real-world APT campaigns where attackers rely on social engineering and trusted services (Zoom/Teams, Telegram, webmail, GitHub) to steal credentials and access cloud accounts. Notable examples include fake meeting lures to deliver malware, and abuse of…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
