Extreme Job was a January 2019 Lazarus spear-phishing campaign that reused document-macro code and filenames seen in earlier operations. A malicious Word document, distributed through a compromised South Korean website, displayed a false compatibility message to persuade recipients to enable macros. The obfuscated macro decrypted and launched an additional executable disguised as a Java update component while also opening a legitimate decoy document, extending tradecraft previously observed in the group’s Arabian Night activity and supporting covert compromise of selected recipients.