Targeted Spear-Phishing Campaigns Exploit Google Ads and WhatsApp

First seen 19 Jan 2026, 18:31 UTC • Cybersecuritynews

•31

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A spear-phishing campaign is utilizing Google Ads to distribute EndRAT malware, targeting users with remote access trojans. Simultaneously, Israel's National Cyber Directorate issued an alert regarding a separate spear-phishing attack that targets professionals in security and defense, using deceptive WhatsApp messages that lead to fake websites designed to steal personal information.

How this analysis works

Attack Flow

11 entities, 11 inferred relationships (STIX 2.1).

Threat Actor (1)

Konni

Technique (6)

Data Breach
Malware
Phishing
T1566.002 - Spearphishing Link
T1566 - Phishing
T1566 - Spearphishing

Campaign (1)

Operation Poseidon

Malware (1)

EndRAT

Affected Platform (2)

Google Ads
WhatsApp

Relationships

Konni uses EndRAT
Konni uses Data Breach
Konni uses Malware
Konni uses Phishing
Konni uses T1566.002 - Spearphishing Link
Konni uses T1566 - Phishing
Operation Poseidon attributed to Konni
Operation Poseidon uses EndRAT
Konni related to T1566 - Spearphishing
Konni related to Google Ads
Konni related to WhatsApp

Targeted Spear-Phishing Campaigns Exploit Google Ads and WhatsApp

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading