Malwarebytes analyzed a Lazarus job-themed spear-phishing campaign using Lockheed Martin decoy documents observed in late 2021 and early 2022. The macro used KernelCallbackTable control-flow hijacking to execute shellcode, which decrypted and manually mapped DLL stages before injecting into explorer.exe and other processes. Later stages abused the Windows Update client by dropping a deceptive wuaueng.dll path and used GitHub as command-and-control infrastructure, a tactic Malwarebytes noted as unusual for Lazarus and difficult for defenders to distinguish from legitimate traffic. The report links the activity to North Korea’s Lazarus APT and emphasizes the group’s continued use of defense-sector recruitment lures and stealthy living-off-the-land execution.