North Korea’s Lazarus group targeted defense and aerospace staff using fraudulent job offers and fake websites, then deployed malware that pulled down and ran a Windows zero-day exploit. The campaign also used websites impersonating Enveil to distribute a trojanized PDF viewer that delivered a new backdoor.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get this in your work inbox: “Hi, I’m reaching out with a job opportunity…” for drones and surveillance roles. Looks flattering, right? This is Lazarus’s “Operation Dream Job.” They send you fake offers, then push you to open crafted documents or install a special PDF viewer from a site that looks like Enveil. That viewer quietly pulls a Windows zero-day exploit, CVE-2026-68820. Here’s the trap: unsolicited recruiter email to your work address, pressure to open their crafted docs, and “you must install our viewer” from a search result that magically ranks first for a niche vendor like Enveil. That combo is the tell. If a recruiter or vendor email wants you to open special docs or install a viewer, stop and forward it to Security, let them open that ‘dream job’ first.
Check Point says North Korea’s Lazarus Group targeted defense and aerospace professionals using convincing fake job offers that led victims to download trojanized PDF software. The campaign used a Windows zero-day (now patched as CVE-2026-68820) to gain full control and hide from security tools,…
Researchers describe a real, ongoing Lazarus-linked campaign where targets are lured with attractive job offers and tricked into downloading a PDF viewer and “job description” documents. Opening the files installs backdoors and, in at least one wave, attackers used a Windows zero-day to gain deep…
Researchers say the North Korea-linked Lazarus group ran “Operation Dream Job,” posing as recruiters and sending fake job offers to lure targets into downloading trojanized PDF tools and opening booby-trapped PDFs. The campaign focused largely on defense-related organizations and used both a…
Researchers tied North Korea’s Lazarus Group to a real-world campaign that approaches professionals with convincing fake recruiter outreach and job offers. Victims are tricked into opening a malicious PDF or installing a fake PDF viewer from lookalike websites, which then installs backdoors and can…
Check Point and Microsoft report North Korea’s Lazarus Group used a long-running “Dream Job” social engineering campaign to target defense-sector job seekers with fake employer sites and trojanized documents/software. Victims were lured into opening malicious PDFs or installing a modified PDF…
Researchers and a Windows app developer uncovered a campaign using lookalike “official” software download websites that rank highly in Google results. The sites initially serve legitimate downloads to build trust, then quietly swap the download links to malware that can steal credentials and…
