Lazarus hackers pair fake job offers with Windows zero-day exploit

Check Point researchers have revealed that the North Korea-linked Lazarus Group is actively exploiting a previously unknown Windows vulnerability, designated as CVE-2026-68820, within its ongoing 'Operation Dream Job' campaign. The attack vector involves luring targets, primarily from the defense industry, with fraudulent recruitment offers for companies like Lockheed Martin. Upon downloading trojanized PDF files, victims are subjected to an infection chain that leverages the AFD.sys driver flaw to escalate privileges and deploy the FudModule rootkit.

Microsoft addressed the critical local privilege escalation issue during its August 11 Patch Tuesday update. In addition to the zero-day, the campaign utilizes modified versions of SecurityPDF and Roundcube webmail servers to establish persistent command-and-control infrastructure.