Spear-Phishing Campaign Leverages Google Ads to Distribute EndRAT Malware

Genians Security Center details "Operation Poseidon," an advanced spear-phishing campaign attributed to the Konni APT that abuses advertising redirect infrastructure (Google DoubleClick and Naver) to mask links and lead victims to compromised WordPress sites hosting EndRAT. The attack delivers a compressed archive containing a malicious LNK that executes an AutoIt script to load AutoIt3.exe and an in-memory EndRAT payload, with reuse of C2 infrastructure, multiple IoCs provided, and recommended mitigations including EDR behavioral detection, URL sandboxing, and threat hunting.