A new spear-phishing campaign known as Operation Poseidon has emerged, exploiting Google’s advertising infrastructure to distribute EndRAT malware while evading traditional security measures.

he attack leverages legitimate ad click tracking domains to disguise malicious URLs, making them appear as trustworthy advertising traffic. This technique effectively bypasses email security filters and reduces user suspicion during the initial infection stage.

The threat actors behind this campaign belong to the Konni APT group, which has been targeting South Korean organizations through sophisticated social engineering tactics.

The attackers impersonate North Korean human rights organizations and financial institutions to lure victims into downloading malicious files.

These files are typically disguised as financial documents, transaction confirmations, or official notices that blend seamlessly into normal business communications.

Operation Poseidon Timeline (Source - Genians) — Operation Poseidon Timeline (Source – Genians)

Genians analysts identified the campaign through detailed forensic analysis of malicious scripts containing internal artifacts.

The researchers discovered that the attackers use compromised WordPress websites as malware distribution points and command-and-control infrastructure.

This approach allows rapid turnover of attack infrastructure, undermining the effectiveness of traditional URL and domain blocking policies.

The malware execution chain begins when victims click on disguised advertising URLs embedded in spear-phishing emails, which redirect them through Google’s ad.doubleclick.net domain to compromised servers hosting malicious ZIP archives.

Malicious URL Embedded in a Legitimate Advertising URL Parameter (Source - Genians) — Malicious URL Embedded in a Legitimate Advertising URL Parameter (Source – Genians)

Inside these archives are LNK shortcut files that trigger the download and execution of AutoIt scripts masquerading as PDF documents. These scripts load EndRAT-variant remote access trojans directly into memory without requiring further user interaction.

The malware includes unique identifier strings such as “endServer9688” and “endClient9688” for command-and-control communications.

Internal build paths revealed the operation’s codename “Poseidon,” suggesting organized management as a distinct operational unit within the Konni APT framework.

Attack Execution and Evasion Techniques

The attack employs multiple layers of detection evasion starting from the email delivery stage. Phishing emails contain large volumes of meaningless English text inserted into invisible HTML areas using the display:none attribute.

This content padding technique confuses AI-based phishing detection systems and spam filters by artificially lengthening email content and disrupting keyword analysis logic.

Compiler Directives of the AutoIt Script (Source - Genians) — Compiler Directives of the AutoIt Script (Source – Genians)

The emails also include transparent 1×1 pixel web beacons that send HTTP requests to attacker-controlled servers when opened, allowing threat actors to track recipient engagement and confirm active email addresses.

The malware delivery URLs exploit the structure of legitimate advertising platforms by embedding command-and-control addresses within URL parameters.

Threat Infrastructure Correlation Diagram (Source - Genians) — Threat Infrastructure Correlation Diagram (Source – Genians)

This makes the redirection appear as normal advertising traffic, significantly lowering detection probability.

The LNK files themselves mask file extensions and icons to appear as legitimate documents, completing a sophisticated attack chain designed to evade both signature-based and behavior-based security frameworks.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New Spear-Phishing Attack Abusing Google Ads to Deliver EndRAT Malware appeared first on Cyber Security News.