Google Bans North Korean Hackers Exploiting Chrome Zero-Day Bug

In early 2024, Google identified and banned two North Korean hacker groups that were leveraging a zero day vulnerability in Chrome, intensifying global focus on cybersecurity. Despite a fix released by Google in February, attackers deployed the exploit before patching was complete, exposing critical weaknesses across multiple industries. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) quickly followed up, requiring all government agencies to patch this vulnerability immediately to mitigate further risk. In 2025 and 2026, the same North Korean threat actors continue to evolve their tactics, making this analysis directly relevant to organizations today.

Overview of North Korean Hacker Activity

North Korea's cyber activities sponsored by the state have been on the radar for years, often targeting high value sectors and critical infrastructure. In addition to the Chrome zero day exploit, these hacker groups linked to notorious North Korean cyber operations like Lazarus have also utilized SWIFT system attacks against international financial institutions. Known for the 2014 Sony Pictures hack, Lazarus and affiliated groups have evolved their methods, employing sophisticated, multistage attacks to penetrate global technology, cryptocurrency, and media sectors. In 2025 and 2026, these groups remain among the most active and some of the most capable threat actors tracked by Western intelligence agencies.

What is a Zero Day Vulnerability?

A zero day vulnerability refers to a security flaw in software or hardware that is unknown to the party responsible for fixing it, typically the developers or manufacturers. Because they are not aware of the vulnerability, no patch or fix exists, leaving the system exposed to potential attacks from malicious actors. These vulnerabilities are highly sought after by cybercriminals who exploit them before developers become aware and can address the issue.

Read our guide to get more details on what a zero day exploit is.

Dream Job Phishing Campaigns

One of the notable methods employed in these attacks is the Dream Job campaign. This tactic preys on professionals, particularly in the United States, by luring them with fake job offers from prestigious companies. Using emails and websites masquerading as those of reputable organizations like Disney, Oracle, and Google, the attackers targeted employees in several high risk sectors including:

• Media
• Cryptocurrency
• Technology
• Domain name registrars
• Web hosting providers
• Software vendors

These fake job offers aimed to compromise organizational security by gaining initial access through unsuspecting employees. The hackers' fake domains, like disneycareers[.]net and find-dreamjob[.]com, present links that appear credible but are carefully designed traps meant to harvest sensitive data or deploy malicious code.

This type of attack is a form of spear phishing that exploits job seekers' trust. Organizations should train employees to verify unexpected job related contact through official channels before clicking any links.

A Common Exploitation Toolkit

The hackers' toolkit is as complex as it is effective, crafted to evade detection by security teams. Google Threat Analysis Group (TAG) researcher Adam Weidemann highlighted the overlapping techniques used by these groups, indicating a shared exploit toolkit across campaigns. This toolkit includes:

1. Fingerprinting Techniques: Attackers used heavily obfuscated JavaScript code to analyze and collect data on the targeted system. This included exploitation scenarios, user agents, and granted permissions.
2. Exploit Kit with Hidden iFrames: Exploits were embedded within both the attackers' and compromised sites, making use of hidden iFrames that redirected targets.
3. Session Specific Keys: Attackers encrypted each stage of the exploit, making it difficult for security teams to track or reproduce the attacks.
4. Multistage Malware: Upon executing the exploit, the attack would request an additional payload to escape the sandbox, escalating the attack if successful.

This robust toolkit not only improved the hackers' chances of a successful breach but also frustrated security efforts to track and contain the threat.

Fake Domains Employed by North Korean Hackers

The following list of fake domains was used in phishing campaigns targeting industries like cryptocurrency, finance, and media. Each of these domains presents a credible facade but is, in fact, a trap controlled by threat actors designed to gather credentials and infiltrate organizational systems:

• disneycareers[.]net
• find-dreamjob[.]com
• indeedus[.]org
• varietyjob[.]com
• ziprecruiters[.]org
• blockchainnews[.]vip
• chainnews-star[.]com
• financialtimes365[.]com
• fireblocks[.]vip

These domains were carefully chosen to imitate popular employment, media, and financial sites, and could easily be mistaken for legitimate websites by employees seeking new job opportunities.

Hackers' Security Measures to Avoid Detection

These North Korean hacker groups are known for their meticulous approach to evading detection. To protect the integrity of their exploit kit, the attackers implemented the following safeguards:

• Time Specific iFrame Serving: The attackers only served the exploit frame during certain time windows, likely chosen to align with when they anticipated the target would visit the page.
• Unique Links and IDs in Email Campaigns: To make detection even more difficult, each phishing email included unique links and identifiers, ensuring each attack attempt remained distinct.
• Encrypted Exploitation Stages: Each stage of the attack was encrypted with session specific keys, meaning that if one phase failed, no additional stages would be served to prevent tracing and reverse engineering of the code.

These tactics reveal a sophisticated understanding of common cybersecurity defenses, enabling these attackers to maintain their persistence in targeted environments despite ongoing detection and prevention efforts.

Why Are Zero Day Vulnerabilities So Dangerous?

A zero day vulnerability like the one exploited in Chrome represents a critical cybersecurity gap. These vulnerabilities are termed zero day because they are unknown to the software provider or vendor until after they have been exploited, giving security teams zero days to prepare before an attack. Zero day exploits are especially valuable to hackers as they offer a way into systems without resistance, enabling them to carry out damaging activities such as data theft, malware installation, or system hijacking.

Defending Against North Korean Cyber Threats in 2026

Organizations in critical sectors must take a proactive approach to defend against sophisticated phishing and zero day attacks. Training and awareness initiatives like those provided by Keepnet's Security Awareness Training can significantly mitigate the risk posed by these attacks. Businesses can also implement phishing simulations to assess employees' ability to recognize these threats in real time.

Because North Korean groups frequently use social engineering conducted over voice calls alongside email phishing, organizations should also test employees' resilience to vishing (voice phishing) attacks. And when phishing emails do reach employees, fast triage matters: Keepnet's Phishing Incident Responder enables security teams to analyze reported emails up to 168x faster, dramatically reducing exposure time.

Additional Steps Organizations Should Take

• Conduct Regular Security Updates: Patch management is crucial, especially for widely used applications like Chrome. Stay vigilant for updates, especially following a zero day alert.
• Implement Email Security Solutions: Tools that detect and filter phishing emails are essential to prevent malicious links and attachments from reaching end users. Keepnet's Email Threat Simulator tests whether your email gateway blocks real threats before they reach employees.
• Limit Access Privileges: Adopt the principle of least privilege to ensure that even if an attacker gains access, they encounter limited system permissions.
• Monitor for Fake Domains: Register similar domains and use tools to monitor for suspicious new domains resembling your own to prevent spoofing attacks.
• Build a Human Risk Management Program: Technical defenses alone cannot stop attacks that exploit human trust. Read our guide on human risk management strategies to build a resilient security culture.

Organizations across industries need to treat cybersecurity as an essential and continuous practice. A comprehensive human risk management platform like Keepnet offers a holistic approach to cybersecurity, helping teams track, educate, and protect their workforce against evolving threats.

Editor's Note: This article was updated on April 10, 2026.