Back Cybersecuritynews

Tax-Themed Google Ads Lead to BYOVD EDR Killer in Huntress

Cybersecuritynews •Tushar Subhra Dutta • March 23, 2026

Every April, millions of Americans rush to file taxes before the deadline — and attackers count on it. A large-scale malvertising campaign, active since at least January 2026, has been exploiting that urgency by placing fake tax form pages through Google Ads, ultimately deploying a kernel-mode EDR killer on victim machines. The campaign targeted U.S. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malvertising Campaign Exploits Tax Season with BYOVD EDR Killer A large-scale malvertising campaign has been identified, leveraging tax-themed Google Ads to deliver a BYOVD-based EDR killer. The campaign, active since January 2026, exploits popular search queries related to tax forms, such as 'W2 tax form' and 'W-9 Tax Forms 2026.' Attackers deploy a kernel-mode EDR killer on victim machines, utilizing rogue ScreenConnect deployments and a vulnerable Huawei audio driver to bypass endpoint defenses. This threat primarily targets U.S. residents during the tax filing season, capitalizing on the urgency to file taxes. Huntress has linked this campaign to significant risks for organizations and individuals alike, as it enables hands-on-keyboard activity for attackers. The current status indicates ongoing exploitation, with no immediate resolution reported. 2 sources 68

Tax-Themed Google Ads Lead to BYOVD EDR Killer in Huntress

The full story

Extracted Entities

Attack Types (1)

Platforms (1)