Zero‑Day LPE in Windows AFD.sys Powers New Dream Job Espionage Campaign
Check Point uncovered a new Dream Job campaign that lures defense professionals with fake recruiter offers. The attackers distribute trojanized PDF viewers exploiting a zero‑day LPE in Windows AFD.sys (CVE‑2026‑68820) to gain SYSTEM rights and evade EDR. Microsoft patched the bug in August 2026, yet the tactic shows how job‑spam can weaponize unseen OS flaws.