New Spear-Phishing Attack Abusing Google Ads to Deliver EndRAT Malware

Operation Poseidon is a targeted spear-phishing campaign attributed to the Konni APT that leverages legitimate Google ad redirection and compromised WordPress sites to deliver an EndRAT variant. The attackers use LNK shortcuts and AutoIt scripts to load the RAT directly into memory, and employ multiple evasion techniques—including invisible content padding, 1×1 tracking beacons, and embedding C2 addresses in advertising URL parameters—while the report provides specific artifacts (e.g., "endServer9688"/"endClient9688").