Researchers tied North Korea’s Lazarus Group to a real-world campaign that approaches professionals with convincing fake recruiter outreach and job offers. Victims are tricked into opening a malicious PDF or installing a fake PDF viewer from lookalike websites, which then installs backdoors and can lead to full control of the computer.
This campaign, tied to the long-running Operation Dream Job effort attributed to the Lazarus Group, relies on convincing recruiter outreach rather than technical exploits alone. Attackers approach professionals, particularly in defense and aerospace roles across France, Germany, Brazil, and India, with fake-but-compelling job offers that reference well-known employer brands. Once trust is established, the conversation moves toward a job description PDF or similar document.
Two infection paths have been observed. In one, victims download an encrypted archive that leads to DLL side-loading. In the other, victims are told they need a special viewer to open the document and are directed to download a trojanized "SecurityPDF" application from a website impersonating Enveil. At least three lookalike domains were created to distribute this fake viewer. Once installed, the malware deploys backdoors that give attackers remote access and the ability to bypass security controls.
The approach works because it exploits normal professional behavior rather than obvious technical red flags. Job-seeking engineers and researchers are primed to expect documents, links, and even software recommendations from recruiters. By referencing recognizable employer names and using a professional-looking impersonation site, the attackers reduced suspicion at each step.
Organizations in defense, aerospace, and related supply chains should train staff, especially engineers, researchers, and program managers, to treat unsolicited recruiter contact as a high-risk channel. Employees should verify recruiters and employers independently before exchanging files, and should never install a viewer or tool suggested by a new contact to open a document. IT and security teams should reinforce that software should only come from official vendor channels, not from search results or links shared during unsolicited conversations. Related MITRE ATT&CK techniques include spearphishing attachment (T1566.001), spearphishing via service (T1566.002), and user execution via malicious file (T1204.002).
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers pose as recruiters on platforms like LinkedIn, offer compelling fake job opportunities at well-known firms, and then push victims to open a malicious PDF or install a trojanized PDF viewer that installs backdoors.
SecurityPDF is a trojanized PDF viewer distributed from websites impersonating the vendor Enveil, which victims are told they need to install in order to view a job-related document.
The campaign has targeted defense and aerospace companies across France, Germany, Brazil, and India, focusing on engineers, researchers, program managers, and other aerospace/defense staff.
The malware deploys backdoors, referred to as ForestTiger/ScoringMathTea and Troy, that give attackers remote access to the infected computer and the ability to steal data.
You get a LinkedIn message: a recruiter offering a dream role at Lockheed Martin or Enveil, out of nowhere. This is Lazarus Group’s “Operation Dream Job”: they send a job PDF, then pressure you to install a special viewer called SecurityPDF from sites like envell.xyz or enveil.online. The moment you run that viewer, it quietly drops backdoors like ForestTiger and Troy, giving them remote access to your machine and your company’s data. If any recruiter ever tells you to install a special viewer or tool to open their job PDF, stop and report it to Security, do not install it, no matter how good the offer sounds.
Researchers describe a real, ongoing Lazarus-linked campaign where targets are lured with attractive job offers and tricked into downloading a PDF viewer and “job description” documents. Opening the files installs backdoors and, in at least one wave, attackers used a Windows zero-day to gain deep…
Check Point says North Korea’s Lazarus Group targeted defense and aerospace professionals using convincing fake job offers that led victims to download trojanized PDF software. The campaign used a Windows zero-day (now patched as CVE-2026-68820) to gain full control and hide from security tools,…
Researchers say the North Korea-linked Lazarus group ran “Operation Dream Job,” posing as recruiters and sending fake job offers to lure targets into downloading trojanized PDF tools and opening booby-trapped PDFs. The campaign focused largely on defense-related organizations and used both a…
Check Point and Microsoft report North Korea’s Lazarus Group used a long-running “Dream Job” social engineering campaign to target defense-sector job seekers with fake employer sites and trojanized documents/software. Victims were lured into opening malicious PDFs or installing a modified PDF…
Microsoft says a Russia-linked group compromised hotel and venue Wi‑Fi captive portals to show convincing fake prompts during the normal “connect to Wi‑Fi” flow. The prompts try to trick travelers into installing malware, running commands, or approving a Microsoft sign-in that grants the attacker…
Microsoft says a Russian-linked group is abusing hotel and conference Wi‑Fi “captive portals” to trick travelers into entering corporate credentials or installing malware. Victims see what looks like a normal Wi‑Fi login flow, but attackers manipulate DNS/website traffic to redirect them to fake…
