A large-scale malvertising campaign active since January 2026 has been observed targeting U.S.-based individuals searching for tax-related documents to serve rogue installers for ConnectWise ScreenConnect that drop a tool named HwAudKiller to blind security programs using the bring your own vulnerable driver (BYOVD) technique.”The campaign abuses Google Ads to serve rogue ScreenConnect (
First seen on thehackernews.com
Jump to article: thehackernews.com/2026/03/tax-search-ads-deliver-screenconnect.html
