Tax-Themed Google Ads Lead to BYOVD EDR Killer in Huntress-Traced Malvertising Campaign

A malvertising campaign using tax-themed Google Ads redirects victims to sites (anukitax.com → bringetax.com) that deliver a rogue ScreenConnect installer (form_w9.msi) to gain hands-on remote access; operators then run a crypter (FatMalloc) and deploy HwAudKiller which drops a Huawei-signed kernel driver (HWAuidoOs2Ec.sys → Havoc.sys) to terminate EDRs, dump LSASS credentials, and execute NetExec for credential harvesting—activity observed across 60+ sessions and likely supporting ransomware or access brokerage. Indicators include domains, filenames, the Huawei driver, and 4sync-hosted payloads; mitigations advised include downloading forms only from IRS.gov, allowlisting approved RMM tools, and monitoring Sysmon/event alerts for kernel driver creation and unsigned binaries executed from ScreenConnect paths.