Tax Search Ads Deliver ScreenConnect Malware Using Huawei Driver to Disable EDR A large-scale malvertising campaign since January 2026 has used Google Ads to lure U.S. tax-searching victims into downloading rogue ConnectWise Control installers that deploy a BYOVD EDR killer called HwAudKiller. The attackers employ stacked cloaking services (Adspect and JustCloakIt) and a legitimately signed Huawei driver (HWAuidoOs2Ec.sys) to blind EDRs, enable LSASS...

A malware campaign since Jan 2026 uses Google Ads with tax search lures to deliver ScreenConnect installers deploying HwAudKiller, a Huawei driver that disables EDRs and enables LSASS credential dumping in the US. #HwAudKiller #ScreenConnect #USA