North Korean Attackers Use Windows Update to Deliver Malware
 
[https://www.tomshardware.com/news/hackers-use-windows-update-for-attack]
 
(excerpts)
 
"Popular North Korean activist group Lazarus is using the Windows Update client to deploy malicious code, thus avoiding security mechanisms, and leveraging Github to serve as a command and control server for its latest attacks, according to Malware bytes Labs. Last week, the Malwarebytes Threat Intelligence team spotted the new campaign in two Word documents used in a spear-phishing campaign pertaining to fake Lockheed Martin job opportunities."
 
"The two documents are known as Lockheed_Martin_JobOpportunities.docx, and Salary_Lockheed_Martin_job_opportunities_confidential.doc. As the names suggest, both these documents appear to bait targets into new job opportunities at Lockheed Martin."
 
 
"part of the injection process uses the Windows Update Client to install a malicious DLL. This is very clever since this technique evades security detection systems."
 
 
 
The bad actors are not resting & are always looking for a new angle --> though phishing is not new. 
 
Malwarebytes make good security software - even the free version is a good secondary scan tool
 

It's odd that installing a DLL via Word wouldn't require administrative authorization. You would think that this reflects bad on Microsoft that they are able to hijack two different Microsoft implementations.