Pulse Detail — Threat Intelligence

PULSE NAME

From W-2 to BYOVD: How a Tax Search Leads to Kernel-Mode AV/EDR Kill

WHITE dylanroth7 2026-03-20 Modified: 2026-03-20

IOCs

MEDIUM VOLUME

During retrospective threat hunting, the Huntress Tactical Response team recently uncovered a large-scale malvertising campaign that has been active since at least January 2026, targeting U.S.-based individuals searching for tax-related documents. The lures are specifically U.S. tax forms (W-2, W-9), and the fake landing pages reference IRS compliance, casting a wide net across employees, freelancers, contractors, and small businesses during filing season. The campaign abuses Google Ads to serve rogue ScreenConnect (ConnectWise Control) installers, ultimately delivering a BYOVD EDR killer that drops a kernel driver to blind security tools before further compromise. Across our customer base, we reported over 60 instances of rogue ScreenConnect sessions tied to this campaign being used as the initial access vector.

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1218.011 T1082 T1055 T1003.001 T1016 T1497 T1547.006 T1562.001 T1027 T1059.003 T1027.002 T1204.001 T1078.004 T1078.003

MALWARE FAMILIES

HwAudKiller FatMalloc

Indicators of Compromise (2 / 25 total)

All FileHash-SHA256 FileHash-SHA1 FileHash-MD5 URL domain hostname

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-SHA1	0ded1a1eabec8ae0ffb0b512871e7b545878437a	—	2026-03-20
FileHash-SHA1	1fa071303fb846308571e64727501fb98b1c2be6	—	2026-03-20

References (1)

↗ https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill