Dream Magic is a Lazarus operation that compromised visitors to selected news content through a watering-hole chain exploiting a vulnerability in the Korean MagicLine authentication product. The attackers inserted malicious links into articles, abused vulnerable South Korean websites as command-and-control infrastructure, and applied IP filtering to restrict delivery to intended companies and institutions. Observed in 2023, the operation retained the same selective watering-hole process previously associated with Lazarus exploitation of INISAFE while changing the vulnerable client software used to gain access.