Tax Search Ads Deliver ScreenConnect Malware Using Huawei Driver to Disable EDR
2026-03-24T19:24:15Z•ec70a8906864ff2a9dce41a2574f79af123f1e85b5ecd69c776128d3faf4da0e
BYOVDCISA KEVCanisterWormEDR bypassGitHub Actions compromiseGoogle Ads abuseHwAudKillerIoT botnetsRMM malwareScreenConnectStoatWaffleTeamPCPTrivyVS Code abusecritical CVEmalvertisingnpm malwarephishingremote code executionsupply chain
What happened
A batch of high-impact cyber activity and disclosures: large-scale malvertising abusing Google Ads to deliver rogue ConnectWise ScreenConnect installers that deploy a BYOVD-based HwAudKiller driver to disable EDR; multiple supply‑chain compromises (Trivy GitHub Actions, CanisterWorm, compromised npm packages) and CI/CD secret theft; targeted phishing campaigns around U.S. tax season and IRS-themed lures delivering RMM and info‑stealers; nation‑state tooling and novel delivery methods (StoatWaffle via VS Code tasks); and multiple critical vulnerabilities disclosed and exploited or under active,
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- ec70a8906864ff2a9dce41a2574f79af123f1e85b5ecd69c776128d3faf4da0e
- Enrichment time
- 2026-03-24T19:24:15Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.