A large-scale malvertising campaign active since January 2026 has been observed targeting U.S.-based individuals searching for tax-related documents to serve rogue installers for ConnectWise ScreenConnect that drop a tool named HwAudKiller to blind security programs using the bring your own vulnerable driver (BYOVD) technique.
„The campaign abuses Google Ads to serve rogue ScreenConnect (
https://thehackernews.com/2026/03/tax-search-ads-deliver-screenconnect.html