Since January 2026, a widespread malvertising operation has been identified, specifically aimed at individuals in the United States who are searching for tax documents. This campaign utilizes Google Ads to distribute malicious installers for ConnectWise ScreenConnect, a remote access tool. The malware, known as HwAudKiller, is designed to disable endpoint detection and response (EDR) systems by employing a technique called bring your own vulnerable driver (BYOVD). This method allows the malware to evade detection by leveraging legitimate drivers to manipulate security measures. Users searching for tax-related information should exercise caution and be aware of the potential risks associated with clicking on suspicious ads.
Malicious Tax Search Ads Distribute ScreenConnect Malware via Huawei Driver
A new malvertising scheme is exploiting tax-related searches to deliver malware, targeting users in the U.S.
3 min readCybersecurity