Fake Job Offer PDFs Are Installing a Windows Rootkit That Disables Your Security Software

The Bait Looked Like a Dream Job

You get a LinkedIn message. A recruiter from a privacy-tech company called Enveil is interested in your background. They send a PDF with the job details. You open it.

That's it. That's the whole attack. By the time the PDF loads, your computer belongs to someone else.

This is not hypothetical. North Korea's Lazarus Group has been running exactly this operation, codenamed Operation Dream Job, sending fake job offers to targets around the world. The payload was a trojanized PDF viewer called SecurityPDF. Opening it triggered a zero-day vulnerability buried inside Windows itself, one that handed attackers the highest possible level of control over your machine before you finished reading the first page of the "offer."

How Does a PDF Take Over a Computer?

Most people assume their antivirus software would catch something like this. That assumption is exactly what the attackers planned around.

When you opened SecurityPDF, it silently exploited CVE-2026-68820, a vulnerability in a Windows kernel driver called AFD.sys. The kernel is the operating layer that sits between software and your hardware. It controls everything. Exploiting a kernel vulnerability means bypassing every security layer above it, because those layers depend on the kernel to be trustworthy.

"SYSTEM-level control" is the technical term. In plain English, it means the attackers could do anything an administrator can do and then some. Delete files. Capture keystrokes. Activate your webcam. Move through your network to other machines.

Then came the second payload: FudModule v3.1. This is a rootkit, a specific kind of malware designed not to steal data immediately but to hide the infection. FudModule runs at the kernel level and actively blinds the endpoint detection and response tools that enterprises and individuals rely on to catch malware. Your antivirus software is still running. It just can't see what's happening underneath it.

That combination, a silent installer plus a tool that blinds the watchmen, is why this attack ran for five weeks without anyone catching it.

The Numbers That Should Alarm You

The rootkit was compiled on July 7. Check Point researchers discovered the zero-day and reported it to Microsoft on July 28. Microsoft issued a patch on August 11, during its regular Patch Tuesday cycle.

Five weeks. Thirty-five days during which any Windows user who encountered this attack had no protection, even with fully updated security software running.

Confirmed victims turned up in France, Germany, Brazil, and India. At least one compromised Western European organization was then used as a launchpad to send further phishing attacks under its own name. Trusted company. Real email domain. Completely under attacker control. The people receiving those follow-on messages had no reason to be suspicious.

This is also the fourth time since 2022 that Lazarus has exploited a zero-day in the same Windows driver, AFD.sys, each time deploying a newer version of FudModule. The pattern suggests they are investing heavily in this specific attack surface, which means more variants are likely.

What should concern you is not just the defense-sector framing. The delivery method, a plausible job offer PDF from a real-sounding company, works on anyone. Founders fielding investor decks. Freelancers receiving client briefs. Anyone who opens documents sent by strangers.

What Do You Do Right Now?

1. Install the August 11 patch immediately.

Go to Settings, then Windows Update, and check for updates right now. The patch for CVE-2026-68820 was released on August 11, 2026, as part of Patch Tuesday. If your machine has not updated since then, you are still exposed. Do not wait for your IT department if you manage your own machine. Do this today.

2. Stop opening PDFs from unknown senders in your default viewer.

If someone sends you a PDF unsolicited, especially one tied to a job offer, a contract, or an urgent opportunity, open it inside a sandboxed environment. Google Drive renders PDFs in the browser without executing anything locally. Upload suspicious files there first.

3. Treat unsolicited job offers as high-risk documents.

The social engineering here works because job offers create urgency and positive emotion. You want to read it. Attackers know that. Any unsolicited outreach that leads to a file download deserves extra scrutiny, regardless of how professional it looks.

4. Enable Microsoft Defender's tamper protection.

Open Windows Security, go to Virus and Threat Protection, then Virus and Threat Protection Settings, and make sure Tamper Protection is on. This does not stop a kernel-level rootkit, but it raises the bar for attacks that haven't reached that depth yet.

5. If you manage other people's computers, audit patch status across every machine.

Unpatched endpoints in your organization are not just a risk to those users. The France victim's compromised network became the attack infrastructure for the next wave. Your machine, if compromised, becomes part of someone else's problem.

6. Report suspicious job-offer messages.

Forward them to your email provider's abuse address and to the platform where you received them. This is not just civic hygiene. Patterns in reports help researchers identify campaigns early.

The Thing That Doesn't Change

The technical details of this attack will age. New CVEs will replace this one. Lazarus will compile FudModule v4. The specific names in this story will fade.

What will not change is the underlying dynamic: the most sophisticated attackers in the world know that the easiest way past technical defenses is through a person making a split-second decision about a file. The five-week window existed because the vulnerability was invisible to software. But the door opened because a human being saw an opportunity and clicked.

Security software is a layer of protection. It is not a substitute for judgment about what you open and from whom.

Do this now:

• Open Windows Update and install all pending patches
• Verify your system shows updates through August 11, 2026 or later
• Do not open PDFs from unknown senders in your local viewer, use a browser-based renderer instead
• Turn on Tamper Protection in Windows Security settings
• Forward any suspicious job-offer files to your email provider's abuse team

Sources

• bleepingcomputer.com
• research.checkpoint.com