LolZarus is a Lazarus Group campaign label, not a discrete malware family. It covered employment-themed phishing documents aimed at defense-sector job applicants, including Lockheed Martin lures. Malicious macros decoded embedded shellcode, hijacked a Windows callback to execute it, retrieved a decoy document, and created a scheduled task that periodically launched a beacon. The chain renamed legitimate Windows utilities and used binaries such as mshta, wscript, wuauclt, wmic, and pcalua for proxy execution.