North Korea’s Lazarus group targeted defense and aerospace staff using fraudulent job offers and fake websites, then deployed malware that pulled down and ran a Windows zero-day exploit. The campaign also used websites impersonating Enveil to distribute a trojanized PDF viewer that delivered a new backdoor.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get this in your work inbox: “Hi, I’m reaching out with a job opportunity…” for drones and surveillance roles. Looks flattering, right? This is Lazarus’s “Operation Dream Job.” They send you fake offers, then push you to open crafted documents or install a special PDF viewer from a site that looks like Enveil. That viewer quietly pulls a Windows zero-day exploit, CVE-2026-68820. Here’s the trap: unsolicited recruiter email to your work address, pressure to open their crafted docs, and “you must install our viewer” from a search result that magically ranks first for a niche vendor like Enveil. That combo is the tell. If a recruiter or vendor email wants you to open special docs or install a viewer, stop and forward it to Security, let them open that ‘dream job’ first.
Check Point says North Korea’s Lazarus Group targeted defense and aerospace professionals using convincing fake job offers that led victims to download trojanized PDF software. The campaign used a Windows zero-day (now patched as CVE-2026-68820) to gain full control and hide from security tools,…
Researchers describe a real, ongoing Lazarus-linked campaign where targets are lured with attractive job offers and tricked into downloading a PDF viewer and “job description” documents. Opening the files installs backdoors and, in at least one wave, attackers used a Windows zero-day to gain deep…
Researchers say the North Korea-linked Lazarus group ran “Operation Dream Job,” posing as recruiters and sending fake job offers to lure targets into downloading trojanized PDF tools and opening booby-trapped PDFs. The campaign focused largely on defense-related organizations and used both a…
Cybercriminals impersonated well-known technology brands including Claude, Google, Apple, and Docusign to steal credentials, payment details, or gain access to devices. The lures used urgent payment failures, software-update prompts, and promised device-performance improvements to persuade people…
China-aligned threat actor TA419 ran real credential-phishing campaigns targeting U.S. AI policy experts at think tanks, universities, and law firms. The operation used trust-building outreach followed by a shortened link that redirected victims through checks to a fake Microsoft/OneDrive sign-in…
A China-aligned group (tracked as TA419) impersonated real AI policy figures and sent benign-sounding outreach to people working on AI policy at US and Japanese organizations. Once targets replied, the attackers sent a shortened link that ultimately led to a fake OneDrive/Microsoft 365 login page…
