MalwareMar 24, 2026

Tax Search Ads Deliver ScreenConnect Malware Using Huawei Driver to Disable EDR

Tax-themed malvertising campaign delivers ScreenConnect malware with EDR-killing Huawei driver since January 2026.

A large-scale malvertising campaign active since January 2026 targets U.S. users searching for tax documents via Google Ads, redirecting them to fake sites that deliver ConnectWise ScreenConnect installers. The payload deploys HwAudKiller, a BYOVD EDR killer leveraging a legitimate signed Huawei audio driver (HWAuidoOs2Ec.sys) to disable endpoint protection from Microsoft Defender, Kaspersky, and SentinelOne. Over 60 malicious ScreenConnect sessions were identified; the threat actor uses dual cloaking services (Adspect and JustCloakIt) to evade security scanners and exhibits behavior consistent with ransomware staging or initial access broker activity.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

The lesson from this incident

Full lesson

Cybercriminals exploited users' trust during tax season by creating convincing fake Google ads that appeared when searching for tax documents, leading to malicious ScreenConnect installations. The attack demonstrates how threat actors abuse legitimate signed drivers (in this case, Huawei's audio driver) to disable endpoint detection and response (EDR) systems through a technique called Bring Your Own Vulnerable Driver (BYOVD). This campaign highlights the dual threats of social engineering targeting seasonal needs and supply chain compromise through the misuse of legitimate software components to evade security controls.

What helps against this

How we list vendors

Huntress research Microsoft affected SentinelOne affected

Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
For exampleMicrosoft Defender for Endpoint SentinelOne Singularity Endpoint Huntress Managed EDR all options
Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
For exampleMicrosoft Defender for Office 365 Proofpoint Core Email Protection Darktrace / EMAIL all options
Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
For exampleKnowBe4 Security Awareness Training SoSafe Awareness Platform Huntress Managed Security Awareness Training all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

domain — bringetax[.]com
malware — HwAudKiller
malware — ScreenConnect
malware — FleetDeck Agent