Shattering the Dream When a Job Offer Becomes a Zero-Day Att...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack
• Blog Title: Shattering the Dream: When a Job Offer Becomes a Zero-Day Attack
• Suggested Section: Windows Hardening > Windows Local Privilege Escalation (kernel post-exploitation and Smart App Control tampering), with cross-references to DLL Hijacking and Phishing Files & Documents

🎯 Content Summary

Campaign overview and impact

Check Point Research analyzes a 2026 wave of the DPRK-linked Lazarus Group's Operation Dream Job. The campaign primarily targeted defense, aerospace, aviation, surveillance-sensor, drone, and robotics organizations, with activity in Europe, India, Brazil, and other regions. Attackers posed as recruiters and used attractive job offers, likely delivered through LinkedIn or messaging applications, to convince victims to open malicious files. ...

🔧 Technical Details

Signed-application DLL sideloading: Place a malicious DLL under the filename expected by a legitimate signed executable, such as libmupdf.dll, in the application's working directory. When the executable uses an unsafe library search order, it loads the attacker-controlled DLL. The DLL can preserve social-engineering credibility by displaying a decoy document while decrypting and reflectively executing malware in memory.

Trojanized document viewer as a payload decoder: Modify every code path that opens documents, including menu-based opening and drag-and-drop, to search input files for a private marker. A marked file can then act as an encrypted executable container. In this campaign, SecurityPDF searched for This document is encrypted with sumatrapdf reader!!!!!!!!!!!!, XOR-decoded the embedded bytes with 0x39, wrote them to %TEMP%\new.exe, and executed the result.

Split deliver...

🤖 Agent Actions

ERROR: Codex exec failed (exit=1).
2026-08-11T19:03:30.454691Z ERROR codex_core::session: Failed to create session: required MCP servers failed to initialize: chack_tools: handshaking with MCP server failed: connection closed: initialize response
Error: thread/start: thread/start failed: error creating thread: Fatal error: Failed to initialize session: required MCP servers failed to initialize: chack_tools: handshaking with MCP server failed: connection closed: initialize response (code -32603)

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 988
• MD files fixed: 5

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening > Windows Local Privilege Escalation (kernel post-exploitation and Smart App Control tampering), with cross-references to DLL Hijacking and Phishing Files & Documents".

Repository Maintenance:

• MD Files Formatting: 988 files processed (5 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0