Qualys analyzed a Lazarus campaign, dubbed LolZarus, that used Lockheed Martin-themed job phishing documents against defense-sector targets. The documents shared author and macro-flow traits with earlier Lazarus lures, decoded embedded shellcode, hijacked execution through WMVCORE.dll and the KernelCallbackTable, and displayed a decoy job document. The payload created a C:\WMAuthorization staging directory, scheduled periodic VBS-based beacons, and used renamed LOLBins such as mshta/wscript, with related variants using wuauclt, wmic, and pcalua. Reported infrastructure included markettrendingcenter.com for decoy retrieval and beaconing, while the campaign demonstrated Lazarus’ continued use of legitimate Windows binaries for stealthy execution.