Malvertising Campaign Exploits Tax Season with BYOVD EDR Killer

A large-scale malvertising campaign has been identified, leveraging tax-themed Google Ads to deliver a BYOVD-based EDR killer. The campaign, active since January 2026, exploits popular search queries related to tax forms, such as 'W2 tax form' and 'W-9 Tax Forms 2026.' Attackers deploy a kernel-mode EDR killer on victim machines, utilizing rogue ScreenConnect deployments and a vulnerable Huawei audio driver to bypass endpoint defenses. This threat primarily targets U.S. residents during the tax filing season, capitalizing on the urgency to file taxes. Huntress has linked this campaign to significant risks for organizations and individuals alike, as it enables hands-on-keyboard activity for attackers. The current status indicates ongoing exploitation, with no immediate resolution reported.

Key Points: • Tax-themed Google Ads are being weaponized to deliver malware. • The campaign has been active since January 2026, targeting U.S. taxpayers. • Attackers use a vulnerable Huawei audio driver to evade endpoint defenses.