Tax-Themed Google Ads Lead to BYOVD EDR Killer in Huntress-Traced Malvertising Campaign

Cybersecurity: Malvertising Campaign Exploiting Tax Season

A significant malvertising campaign has been identified, active since January 2026, targeting individuals in the United States searching for tax forms such as W-2 and W-9. The campaign leverages fake tax form pages advertised through Google Ads to deploy a kernel-mode EDR killer on victim machines.

The attack initiates when users search for tax forms and are directed to a rogue landing page that mimics IRS compliance portals. The page redirects to a malicious site delivering a rogue ScreenConnect installer named form_w9.msi. ScreenConnect, a legitimate remote management tool, is used by attackers to gain full access to the victim's machine.

After installation, attackers gain hands-on-keyboard access without enterprise approval, leading to a multi-stage operation that employs tools such as FatMalloc and FleetDeck. The final payload, HwAudKiller, uses an undocumented Huawei audio driver to disable various security processes, including Windows Defender and SentinelOne, from kernel mode.

The campaign's primary objective appears to involve either ransomware deployment or initial access brokerage. The attack also includes a secondary lure involving a fake Google Chrome update page, indicating a broader, organized operation utilizing multiple social engineering tactics.

Download tax forms only from official sources like IRS.gov. Exercise caution with sponsored search results for government documents. IT teams should allowlist approved remote management tools and monitor for suspicious ScreenConnect instances. Set alerts for Sysmon Event IDs 6 and 7045, indicating kernel driver creation from temporary directories.

This malvertising campaign highlights the need for vigilance during tax season and the importance of robust endpoint security measures to thwart sophisticated attacks.

Based on reporting by Cyber Security News.