Back Gbhackers

Tax Scam Google Ads Push BYOVD EDR Killer, Huntress Finds

Gbhackers •Mayura Kathir • March 23, 2026

Tax-themed Google Ads are being weaponized to deliver a BYOVD-based EDR killer, with Huntress linking a large-scale malvertising campaign to rogue ScreenConnect deployments and a vulnerable Huawei audio driver used to blind endpoint defenses before hands-on-keyboard activity. Google Ads for queries such as “W2 tax form” and “W‑9 Tax Forms 2026” led to realistic […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malvertising Campaign Exploits Tax Season with BYOVD EDR Killer A large-scale malvertising campaign has been identified, leveraging tax-themed Google Ads to deliver a BYOVD-based EDR killer. The campaign, active since January 2026, exploits popular search queries related to tax forms, such as 'W2 tax form' and 'W-9 Tax Forms 2026.' Attackers deploy a kernel-mode EDR killer on victim machines, utilizing rogue ScreenConnect deployments and a vulnerable Huawei audio driver to bypass endpoint defenses. This threat primarily targets U.S. residents during the tax filing season, capitalizing on the urgency to file taxes. Huntress has linked this campaign to significant risks for organizations and individuals alike, as it enables hands-on-keyboard activity for attackers. The current status indicates ongoing exploitation, with no immediate resolution reported. 2 sources 68

Extracted Entities

Tax Scam Google Ads Push BYOVD EDR Killer, Huntress Finds

The full story

Extracted Entities

Attack Types (1)

Platforms (1)

Tools (1)