How a Tax Search Leads to Kernel-Mode AV/EDR Kill

A large-scale malvertising campaign targeting U.S.tax form searchers has been uncovered. The attack chain begins with Google Ads, using dual commercial cloaking services to evade detection. Victims are directed to rogue ScreenConnect installers, leading to a multi-stage crypter that ultimately deploys a BYOVD (Bring Your Own Vulnerable Driver) tool. This tool, named HwAudKiller, exploits a previously undocumented Huawei audio driver to terminate antivirus and EDR processes from kernel mode. The campaign's sophistication lies in its use of commodity tools and services, combining free-tier ScreenConnect instances, off-the-shelf crypters, and a signed driver with an exploitable weakness. The attackers consistently deploy multiple remote access tools on compromised hosts for redundancy, indicating a likely pre-ransomware or initial access broker operation.

• Placeholder Domains Whose Ads Serve ScamsCampaign2026-09-26
• Fake "View & Sign" and Adobe Acrobat Lures Deliver Attacker-Configured ScreenConnect ClientsMalware2026-10-29
• Managed for Malice: How Attackers Turn MDM into Remote AccessCampaign2026-10-28
• Lunex Unmasked: A New Information Stealer Deployed Through BYOVDMalware2026-09-26
• Recent AI-Assisted Cyber Attacks in Japan: Investigating Attack Infrastructure and TechniquesCampaign2026-10-21