Operation Blackhat Voice was a targeted spearphishing campaign observed from late February through early March 2019 against South Korean organizations and people working on North Korea-related matters. The attacker sent password-protected archives containing executables disguised with double extensions as audio recordings, then played a genuine Chinese-language recording while extracting separate 32-bit and 64-bit malicious DLLs. The campaign name reflected both an operator account used to configure command infrastructure and the distinctive recorded-voice lure. Researchers assessed the activity as part of a state-sponsored APT operation but did not attribute it to a specific group.