Tax-Themed Google Ads Deliver Rogue ScreenConnect Installers and BYOVD EDR Killer
Summary
Huntress reports a campaign active since January 2026 using tax-themed Google Ads, stacked cloaking, and rogue ScreenConnect installers to deploy HwAudKiller, which uses a signed Huawei driver to terminate security processes.
Key points
- Huntress identified more than 60 malicious ScreenConnect sessions associated with the campaign targeting U.S. users searching for tax documents.
- Adspect and JustCloakIt are used in stacked cloaking layers to show benign content to scanners while directing real users to payloads.
- Rogue ScreenConnect installers deploy a multi-stage crypter and HwAudKiller, which uses the signed Huawei driver HWAuidoOs2Ec.sys to terminate security processes from kernel mode.
- The driver-based activity targeted processes associated with Microsoft Defender, Kaspersky, and SentinelOne.
- In one observed instance, attackers reportedly dumped credentials from LSASS and used NetExec for network reconnaissance and lateral movement.
- Additional ScreenConnect trial instances and FleetDeck Agent were deployed for remote access redundancy; Huntress says the campaign’s exact objectives remain unclear.
Article Details
- Attack Vectors
- Sponsored Google Ads for tax-related searches direct users to a malicious landing page that delivers a rogue ScreenConnect installer.
- Adspect and JustCloakIt apply layered cloaking to show benign content to scanners and ad-review systems while serving the payload to real visitors.
- The rogue installer deploys a multi-stage crypter and HwAudKiller, which uses the signed Huawei driver HWAuidoOs2Ec.sys to terminate EDR processes from kernel mode.
- The crypter attempts to evade antivirus engines and emulators by allocating 2 GB of memory, filling it with zeros, and freeing it.
- ScreenConnect and FleetDeck Agent are deployed as remote-access tools; in one reported instance, the access was used for LSASS credential dumping, network reconnaissance, and lateral movement.
MITRE ATT&CK
T1003.001 · LSASS MemoryIn one reported instance, the threat actor dumped credentials from LSASS process memory.T1068 · Exploitation for Privilege EscalationHwAudKiller uses the vulnerable, signed Huawei driver HWAuidoOs2Ec.sys to operate from kernel mode and terminate security processes.T1204.002 · Malicious FileVictims searching for tax forms are lured into downloading and running a rogue ScreenConnect installer.T1219 · Remote Access ToolsThe campaign uses ScreenConnect and FleetDeck Agent for remote access to compromised hosts.T1562.001 · Disable or Modify ToolsHwAudKiller uses a kernel driver to terminate processes associated with Microsoft Defender, Kaspersky, and SentinelOne.
People
Malware
Vendors
ConnectWisetax-searching victims into downloading rogue ConnectWise Control installers that deploy a BYOVD EDR killer called HwAudKiller.GoogleA large-scale malvertising campaign since January 2026 has used Google Ads to lure U.S.HuaweiThe attackers employ stacked cloaking services (Adspect and JustCloakIt) and a legitimately signed Huawei driver (HWAuidoOs2Ec.sys) to blind EDRs, enable LSASS credential dumping, and facilitate further compromise.KasperskyHwAudKiller that uses the BYOVD technique to terminate processes associated with Microsoft Defender, Kaspersky, and SentinelOne.MicrosoftUnlike recent campaigns highlighted by Microsoft that leverage tax-themed lures, the newly flagged activity employs commercial cloaking services to avoid detection by security scanners and abuses a previouslySentinelOneuses the BYOVD technique to terminate processes associated with Microsoft Defender, Kaspersky, and SentinelOne.
Products
ConnectWise ScreenConnecttax-searching victims into downloading rogue ConnectWise Control installers that deploy a BYOVD EDR killer called HwAudKiller.Google AdsA large-scale malvertising campaign since January 2026 has used Google Ads to lure U.S.HWAuidoOs2Ec.sysThe attackers employ stacked cloaking services (Adspect and JustCloakIt) and a legitimately signed Huawei driver (HWAuidoOs2Ec.sys) to blind EDRs, enable LSASS credential dumping, and facilitate further compromise.KasperskyHwAudKiller that uses the BYOVD technique to terminate processes associated with Microsoft Defender, Kaspersky, and SentinelOne.Microsoft Defender Antimalware Platformkiller codenamed HwAudKiller that uses the BYOVD technique to terminate processes associated with Microsoft Defender, Kaspersky, and SentinelOne.ScreenConnectRogue ScreenConnect installers drop a crypter and the BYOVD EDR killer HwAudKiller that leverages HWAuidoOs2Ec.sys.SentinelOneuses the BYOVD technique to terminate processes associated with Microsoft Defender, Kaspersky, and SentinelOne.
Tools
AdspectThe attackers employ stacked cloaking services (Adspect and JustCloakIt) and a legitimately signed Huawei driver (HWAuidoOs2Ec.sys) to blind EDRs, enable LSASS credential dumping, and facilitate further compromise.FleetDeck AgentThe threat actor has also been found to drop additional Remote Monitoring and Management (RMM) tools like FleetDeck Agent for redundancy and ensuring persistent remote access.JustCloakItThe attackers employ stacked cloaking services (Adspect and JustCloakIt) and a legitimately signed Huawei driver (HWAuidoOs2Ec.sys) to blind EDRs, enable LSASS credential dumping, and facilitate further compromise.NetExecfrom the Local Security Authority Subsystem Service (LSASS) process memory, as well as use tools like NetExec for network reconnaissance and lateral movement.