Lazarus Uses Fake Résumés to Target Korea

North Korea-linked Lazarus targeted South Korean organizations with tailored phishing emails that directed recipients to fake portfolio and résumé websites. The sites, including GitHub Pages hosting a purported senior network-appliance developer résumé, abused vulnerable financial-security software to install malware. The campaign shows how a convincing job-related link can become the first step in a targeted compromise.

Key findings

• Lazarus's Operation FlashHole targeted at least three South Korean organizations in construction, software, and wire-communication equipment manufacturing.
• Attackers sent selective spear-phishing emails linking to fabricated, target-relevant portfolio and résumé sites.
• One malicious GitHub Pages site presented a résumé for a purported senior network-appliance developer and used a likely AI-generated profile photograph.
• Visiting the malicious site triggered an infection chain that abused INISAFE CrossWeb EX, a widely used South Korean financial-security product.
• The malware framework could collect system and browser data, steal files, log keystrokes, take screenshots, and deploy additional backdoors.

Who’s being targeted

• Commonly targeted roles: Recruiting, Human Resources, Engineering, IT, Network Administration, Employees who review job applications or external technical portfolios, South Korean employees using online banking or government-service security software.
• Affected industries: Construction, Software, Wire-communication equipment manufacturing, Financial services, Government services, Telecommunications, Semiconductor manufacturing.
• Attack channels: email, website.
• Impersonated: A purported senior network-appliance developer.

Awareness takeaways

• Treat unsolicited links to applicant portfolios and résumés as untrusted, even when the role, skills, and website look highly relevant to your work.
• Verify an applicant or sender through an independent channel before opening a portfolio link, especially if the page is hosted on a personal or unfamiliar GitHub Pages address.
• Keep browser-connected financial-security and authentication software updated, because a phishing click can trigger exploitation of outdated software rather than merely display a fake webpage.

Red flags to watch for

• An unsolicited applicant link is hosted on an unfamiliar GitHub Pages site.
• The profile photograph may be AI-generated.
• The message is unusually tailored to the recipient's technical role or organization.