[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKRV_UlMeYjZ6Ow0GFxLfMawysMZmr1J8kstk3xpzMH0":3},{"article":4,"iocs":35,"watch_terms":49,"solutions":50,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":17,"category":18,"article_tags":22},"1f98df0e-cb49-4b92-bc6b-2db3a6f2a38d","Tax Search Ads Deliver ScreenConnect Malware Using Huawei Driver to Disable EDR","tax-search-ads-deliver-screenconnect-malware-using-huawei-driver-to-disable-edr","A large-scale malvertising campaign active since January 2026 has been observed targeting U.S.-based individuals searching for tax-related documents to serve rogue installers for ConnectWise ScreenConnect that drop a tool named HwAudKiller to blind security programs using the bring your own vulnerable driver (BYOVD) technique. \"The campaign abuses Google Ads to serve rogue ScreenConnect (","A large-scale malvertising campaign active since January 2026 targets U.S. users searching for tax documents via Google Ads, redirecting them to fake sites that deliver ConnectWise ScreenConnect installers. The payload deploys HwAudKiller, a BYOVD EDR killer leveraging a legitimate signed Huawei audio driver (HWAuidoOs2Ec.sys) to disable endpoint protection from Microsoft Defender, Kaspersky, and SentinelOne. Over 60 malicious ScreenConnect sessions were identified; the threat actor uses dual cloaking services (Adspect and JustCloakIt) to evade security scanners and exhibits behavior consistent with ransomware staging or initial access broker activity.","Tax-themed malvertising campaign delivers ScreenConnect malware with EDR-killing Huawei driver since January 2026.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F03\u002Ftax-search-ads-deliver-screenconnect.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjHstwfvuhTqeOC7VWnSCBcxuxkGXQo_98_9hK16L_vSpzSRSYHXlBOeg2O61FYeF2rcfwnXFxzQHEkDyXYB6C_GtMIB-qEfIM_K3vMu-C_OHBNk5eOdwofhao0How3UZLVM1bQ4R5MzrGMSpIk74c_b0UI8ri7Itube7MGnrwEEoEHy-kOq1unklYy9zR5\u002Fs1600\u002Ftax-docs.jpg","2026-03-24T17:05:00+00:00","2026-03-24T19:00:08.230572+00:00",9,[],"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":17,"icon":19,"name":20,"slug":21},null,"Malware","malware",[23,28,30],{"category":24},{"id":25,"icon":19,"name":26,"slug":27},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":29},{"id":17,"icon":19,"name":20,"slug":21},{"category":31},{"id":32,"icon":19,"name":33,"slug":34},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[36,40,43,46],{"type":37,"value":38,"context":39},"domain","bringetax[.]com","Malicious landing page serving fake ScreenConnect installers",{"type":21,"value":41,"context":42},"HwAudKiller","EDR killer tool using BYOVD technique to disable security products",{"type":21,"value":44,"context":45},"ScreenConnect","ConnectWise Control remote access tool abused for initial compromise and payload delivery",{"type":21,"value":47,"context":48},"FleetDeck Agent","RMM tool deployed for redundant persistent remote access",[],{"controls":51,"vendors":131},[52,81,107],{"slug":53,"name":54,"problem":55,"products":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":82,"name":83,"problem":84,"products":85},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[86,91,99],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":87,"product_name":88,"url":89,"description":90},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"slug":108,"name":109,"problem":110,"products":111},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[112,119,126],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":108,"product_name":116,"url":117,"description":118},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":120,"product_name":123,"url":124,"description":125},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":127,"product_name":128,"url":129,"description":130},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[132,135,138],{"slug":74,"name":75,"logo_path":76,"roles":133},[134],"reported_by",{"slug":58,"name":59,"logo_path":60,"roles":136},[137],"affected",{"slug":66,"name":67,"logo_path":68,"roles":139},[137],{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":153},"tax-season-malvertising-campaign-exploits-user-trust-and-legitimate-drivers","Tax Season Malvertising Campaign Exploits User Trust and Legitimate Drivers","Cybercriminals exploited users' trust during tax season by creating convincing fake Google ads that appeared when searching for tax documents, leading to malicious ScreenConnect installations. The attack demonstrates how threat actors abuse legitimate signed drivers (in this case, Huawei's audio driver) to disable endpoint detection and response (EDR) systems through a technique called Bring Your Own Vulnerable Driver (BYOVD). This campaign highlights the dual threats of social engineering targeting seasonal needs and supply chain compromise through the misuse of legitimate software components to evade security controls.",[145,146,147,148,149,150,151,152],"CIS Control 7","CIS Control 14","CIS Control 16","NIST AC-3","NIST SI-3","NIST SI-4","MITRE ATT&CK T1566","MITRE ATT&CK T1068",{}]