North Korean cybercriminals have adopted a novel tactic exploiting Google’s advertising infrastructure to slip phishing links past email security systems, part of their longstanding efforts to steal data from human rights advocates and South Korean institutions.

In a recent campaign dubbed “Operation Poseidon” by researchers, the advanced persistent threat (APT) group Konni disguised malicious download links as legitimate Google advertising URLs, South Korean cybersecurity firm Genians said in a threat intelligence report released Monday.

The campaign, which ran from October through December, primarily targeted individuals connected to North Korean human rights issues and South