Back Nknews

North Korean hackers exploit Google advertising links to steal data

Nknews • January 21, 2026

Researchers say Konni threat group used novel tactic to target activists and South Korean financial institutions

Shreyas Reddy January 21, 2026

North Korean cybercriminals have adopted a novel tactic exploiting Google’s advertising infrastructure to slip phishing links past email security systems, part of their longstanding efforts to steal data from human rights advocates and South Korean institutions.

In a recent campaign dubbed “Operation Poseidon” by researchers, the advanced persistent threat (APT) group Konni disguised malicious download links as legitimate Google advertising URLs, South Korean cybersecurity firm Genians said in a threat intelligence report released Monday.

The campaign, which ran from October through December, primarily targeted individuals connected to North Korean human rights issues and South

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korean Hackers Use Google Ads for Phishing Campaign Against South Korea North Korean hackers from the Konni threat group have launched a campaign named 'Operation Poseidon' that exploits Google’s advertising infrastructure to distribute phishing links. This tactic targets human rights advocates and South Korean financial institutions, allowing the attackers to bypass traditional email security measures. 1 sources 18

Extracted Entities

North Korean hackers exploit Google advertising links to steal data

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Campaigns (1)

Companies (1)

Industries (1)