Executive Summary

Would you open a PDF if a recruiter sent you a great job opportunity?

Hackers are betting that you will.

A sophisticated cyberattack uncovered by Check Point Research used fake recruiters, convincing job opportunities, legitimate-looking documents, and even fake websites that appeared prominently in search results to trick people into installing malicious software.

Once inside, the attackers could gather information about the computer, capture screenshots, download additional malware and ultimately gain powerful access to the system. The campaign even exploited a previously unknown Windows vulnerability—a zero-day—that Microsoft has since patched.

The attack targeted organizations in defense, aerospace and aviation, but the lesson applies to every organization.

An employee doesn’t have to be doing company business to put a company computer at risk. Checking a personal email, responding to a recruiter or opening a job description on a work computer can be enough.

And that’s the bigger takeaway:

Cybersecurity can’t depend on your employees recognizing every bad click.

Training matters. But organizations also need layers of protection—patched systems, limited administrative privileges, application controls, endpoint protection, web filtering and other safeguards—so that when someone eventually makes a mistake, one click doesn’t become one very bad day.

One Click Away from a Bad Day: When a Dream Job Becomes a Cyberattack

It starts with a message most people would be excited to receive.

A recruiter reaches out with an attractive job opportunity. The company is recognizable. The position sounds legitimate. There’s a job description to review, and everything seems professional.

You open the file.

And that one seemingly harmless action could give an attacker a foothold on your computer.

That’s the scenario behind a sophisticated cyberattack campaign recently analyzed by Check Point Research—and it’s another reminder that sometimes you really are one click away from a bad day.

The Job Offer Was the Bait

The campaign, known as Operation Dream Job, has been linked to the Lazarus threat group and has targeted organizations around the world, particularly those in defense, aerospace, and aviation.

The attackers pose as recruiters offering attractive employment opportunities at well-known companies. Victims are then directed to download files associated with the supposed position.

And this wasn’t simply a poorly written phishing email with an obviously suspicious attachment.

The attackers built a much more convincing experience.

In one version of the attack, the victim downloaded a package containing what appeared to be a legitimate PDF viewer and a job-description PDF. Behind the scenes, malicious components were executed while the victim saw what appeared to be the document they expected.

In another version, attackers distributed a modified PDF viewer called SecurityPDF. When a specially crafted PDF was opened using that application, malicious software hidden inside the file was executed.

To make the deception even more believable, researchers discovered websites impersonating a legitimate technology company that distributed the malicious PDF viewer. Some of those fake websites even appeared prominently in search results.

In other words, a victim could receive a recruiting message, search the web for the software mentioned in it, find what looked like the appropriate website—and still end up downloading the attacker’s software.

One Click Was Only the Beginning

Once the computer was compromised, the attackers had sophisticated tools at their disposal.

The malware could gather information about the computer, examine running processes, capture screenshots and download additional malicious components.

Researchers also discovered that the attackers were exploiting a previously unknown Windows vulnerability—what’s commonly called a zero-day vulnerability—to gain extremely powerful SYSTEM-level access.

That vulnerability, CVE-2026-68820, affected Microsoft’s Windows Ancillary Function Driver (AFD.sys). Check Point reported the vulnerability to Microsoft, and Microsoft released a security update on August 11, 2026.

The attackers also deployed a newly identified backdoor researchers named Troy, capable of performing numerous remote actions including executing commands, transferring files and interacting with processes on the compromised computer.

That’s an enormous amount of access resulting from something that started with a believable job opportunity.

The Bigger Lesson for Every Organization

Most businesses aren’t defense contractors, and most employees won’t be specifically targeted by a sophisticated nation-state threat group.

But the technique behind this attack should get everyone’s attention.

Cybercriminals understand that we’re becoming more skeptical of traditional phishing emails. So instead of relying solely on a suspicious link or attachment, they’re creating an entire environment designed to establish trust.

A recruiter can look legitimate.

A company can be real.

A job description can look authentic.

A website can appear professional.

A search engine can even lead you to the attacker’s site.

That means the old advice to simply “look for suspicious emails” isn’t enough anymore.

Your Employees Have Lives Outside of Work

There’s another important lesson here for organizations.

An employee doesn’t necessarily have to be conducting company business to put a company computer at risk.

Someone could be checking a personal email account, responding to a recruiter on LinkedIn, researching another company or simply reviewing a job opportunity during lunch.

From the employee’s perspective, they’re doing something personal.

From the computer’s perspective, however, there’s no distinction.

If malicious software executes on a company-owned device, the organization’s systems, credentials and data may suddenly be exposed.

That’s why cybersecurity can’t depend entirely on people recognizing every attack before they click.

Build Security Around People

Employees should absolutely be trained to recognize suspicious messages, unexpected downloads and unusual requests.

But people will eventually make mistakes.

Effective cybersecurity assumes that possibility and builds layers of protection around them.

That means keeping operating systems and applications patched, controlling which applications employees can install, limiting administrative privileges, using endpoint detection and response tools, filtering malicious websites and downloads, and monitoring devices for unusual behavior.

Organizations should also consider policies around personal activity on company-owned computers—particularly installing software or opening files received through personal email, messaging apps and social networks.

The goal isn’t to make employees afraid to click anything.

It’s to make sure one click doesn’t become one very bad day.