Tax Search Ads Deliver ScreenConnect Malware Using Huawei Driver to Disable EDR

A malvertising campaign active since January 2026 targets U.S. users searching for tax documents to deliver ScreenConnect malware with an EDR-killing payload.

• •Attackers abuse Google Ads with tax-themed lures (e.g., "W2 tax form") to redirect victims to rogue sites serving ConnectWise ScreenConnect installers
• •Two commercial cloaking services (Adspect and JustCloakIt) are stacked to serve benign pages to scanners while delivering payloads to real victims
• •A tool named HwAudKiller uses the BYOVD technique with a signed Huawei kernel driver (HWAuidoOs2Ec.sys) to terminate EDR processes from kernel mode
• •Post-compromise activity includes LSASS credential dumping, network reconnaissance with NetExec, and deployment of additional RMM tools like FleetDeck for persistence
• •