Representational Image (Image Credit: Getty Images)
Hyderabad: Lazarus (or Lazarus Group), a hacking group linked to North Korea, is tricking people with fake job offers to break into computers, mainly at defence companies. According to cybersecurity researchers at Check Point — a cybersecurity firm — the hackers are also using a secret weakness in Windows that nobody knew about until now.
The attack is part of a long-running scheme called Operation Dream Job. In this, hackers pretend to be job recruiters from big, well-known companies. They offer people exciting job opportunities to trick them into downloading harmful files. One fake document even used a real job description from Lockheed Martin, a major defence firm.
Check Point notes that initially, it could not figure out exactly how the hackers got in touch with their victims. However, when the firm tracked past cyber attacks occurred in Operation Dream Job, they found out that Lazarus’ hackers likely reached out via professional networking websites like LinkedIn or messaging apps.
The researchers said that hackers pose as recruiters who provide “enticing job opportunities”. Ultimately, they direct their victims to download malicious files.
How the Windows bug gives hackers full control?
Researchers found two different ways the hackers were breaking in. In the first method, a victim is convinced to download a locked ZIP file. Inside, there are three things: a genuine, trusted PDF viewer program, a malicious file hidden alongside it, and a secret payload disguised as a PDF.
Check Point’s researchers explained, “When the victim launches the executable, the malicious DLL libmupdf.dll is loaded via DLL sideloading. The DLL extracts a decoy PDF document from the encrypted payload and displays it to the user, while simultaneously extracting, decrypting, and executing an embedded payload directly in memory.”
Once this happens, harmful software called MISTPEN starts running quietly in the background. It studies the infected computer and downloads more harmful tools.
One of these tools uses a bug called CVE-2026-68820, found in a core part of Windows called the AFD.sys driver. This bug lets the hackers take full control of the computer, as system administrator. With that access, hackers install FudModule, a tool built to switch off security software so it cannot catch them.
Check Point tested this attack on a fully updated Windows 11 computer and confirmed the bug was real and unknown to Microsoft. It had already been used in cyber attacks since early July 2026. The cybersecurity firm told Microsoft about the bug, and the tech giant fixed it on August 11, 2026 as part of its usual monthly update.
Trojanised PDF viewer
Researchers also found a second method used since July. It looks similar to an earlier Lazarus campaign reported by security firm ESET in 2025.
In this version, the hackers sent fake job offers while pretending to be Enveil, a real privacy technology company. They told victims to download a programme called SecurityPDF, which looks like a normal PDF reader but has been secretly altered.
When someone opens a specially made PDF file using SecurityPDF, it quietly installs a backdoor called Troy. This gives the hackers remote access to the victim’s computer.
To make this cyber attack look real, the hackers built at least three fake websites pretending to belong to Enveil. Some of these fake sites even showed up at the top of search results. Notably, Check Point found no proof that the real Enveil company was hacked or involved in any way.
“Although we did not directly observe how the threat actor incorporated these websites into the phishing campaign, we assess that they were likely used to separate the delivery of the trojanised PDF viewer from the delivery of the crafted PDF document,” the researchers said.
They added, “In this scenario, victims would first receive the malicious PDF file through a phishing message and later be instructed to download the PDF viewer from what appears to be the vendor’s legitimate website.”
Hacked email servers used to hide traffic
Check Point researchers note that Lazarus also broke into Roundcube webmail systems and other web servers, using them to secretly pass information back and forth without being noticed.
Some of these servers had a known vulnerability called CVE-2025-49113. Researchers mention hackers used stolen passwords to authenticate web servers before using the vulnerability (CVE-2025-49113) to install RelayShell, a specialised PHP web shell used by hackers.
Operation Dream Job spread across the world
Check Point says most of the cyber attacks were focused mainly in organisations in Western Europe and India, with some activity seen in South America as well. In one case, hackers broke into a company in France and used it to send spear-phishing fake job messages to other targets.
“The latest Operation Dream Job campaign demonstrates that Lazarus continues to evolve both its malware capabilities and operational tradecraft,” Check Point said.
A similar scam from a Russian-linked group
Lazarus is not the only group using fake jobs to trick people. Ukraine’s cyber defence team, CERT-UA, has spotted a similar trick being used by a group called UAC-0145. This group is linked to Sandworm, a well-known Russian state-backed hacking team also called APT44 or Seashell Blizzard. This cyber attack campaign running since at least May 2026, targeted IT staff and system administrators with fake job offers.
How to safeguard from such attacks?
Sergey Shykevich, Director of Threat Intelligence at Check Point Software, in a statement shared with The Hacker News said, “When the website, the download and the recruiter all appear authentic, the old advice to ‘spot the phishing link’ is no longer easily applicable. Staying safe now means assuming that trust itself can be counterfeited: patch the moment updates land, verify software through official channels rather than search rankings, and extend zero-trust thinking to the legitimate-looking sites and partners we interact with every day.”
Click Here For The Original Source.
