Listen to this Post
A New Wave of Tax-Themed Cybercrime
Every year, tax season brings urgency, paperwork, and unfortunately, opportunity for cybercriminals. In 2026, attackers have escalated their tactics, launching a sophisticated campaign that targets U.S. taxpayers at scale. By exploiting trust in familiar tax documents like W-2 and W-9 forms, threat actors are using deceptive online ads to lure victims into a dangerous trap. What appears to be a simple download quickly turns into a full system compromise, highlighting how modern cyberattacks blend social engineering with advanced technical evasion.
A Massive Malvertising Campaign Uncovered
Since at least January 2026, cybersecurity researchers have identified a widespread malvertising operation targeting individuals searching for tax forms. These malicious campaigns leverage Google Ads, presenting fake links disguised as legitimate W-2 and W-9 documents. Unsuspecting users who click these ads are redirected to download a rogue installer disguised as a legitimate tool.
The downloaded file installs a compromised version of ScreenConnect, a remote access application typically used for IT support. However, in this campaign, it becomes the gateway for attackers to gain unauthorized control over victims’ systems. Once installed, this software allows attackers to operate remotely, often without immediate detection.
Cloaking Techniques That Bypass Detection
To maintain the longevity of their malicious ads, attackers employ advanced cloaking services such as Adspect and JustCloakIt. These tools are specifically designed to deceive security scanners by showing benign content during automated checks while redirecting real users to harmful payloads.
This dual-layer deception ensures that the malicious ads remain active for extended periods, increasing the number of potential victims. It also demonstrates how attackers are evolving alongside ad platform security measures, constantly refining their ability to stay undetected.
Persistence Through Redundant Access Channels
Once inside a system, attackers focus heavily on maintaining access. They deploy multiple instances of ScreenConnect relays, often using free-tier services, along with backup remote management tools. This redundancy ensures that even if one access point is discovered and removed, others remain active.
Such persistence techniques reflect a calculated approach, where attackers anticipate defensive actions and prepare fallback mechanisms. It turns a simple infection into a long-term foothold within the compromised environment.
The FatMalloc Crypter: A Clever Evasion Tool
A key component of this attack chain is a multi-stage crypter known as FatMalloc. This malware uses an unusual but effective technique: it allocates approximately 2 gigabytes of memory to overwhelm antivirus emulators. By exhausting system resources, it causes security tools to time out, allowing the malicious payload to slip through undetected.
FatMalloc also employs indirect execution methods, including the Windows multimedia timer API, to execute its payload stealthily. Additionally, it obfuscates its code by prefixing API names with the letter “Y,” making signature-based detection more difficult.
These techniques highlight the increasing sophistication of malware designed specifically to evade modern endpoint protection systems.
Exploiting a Legitimate Huawei Driver
The final stage of the attack introduces an EDR-disabling tool known as HwAudKiller. This malware uses a legitimate, digitally signed Huawei audio driver (HWAudioOs2Ec.sys) to gain kernel-level privileges. Despite its authenticity, the driver contains a vulnerability that allows it to terminate any process without proper validation.
By exploiting this flaw, the malware systematically disables endpoint detection and response tools, including major security solutions. This effectively blinds the system’s defenses, leaving it fully exposed to further exploitation.
The use of legitimate drivers in this manner is a hallmark of “Bring Your Own Vulnerable Driver” attacks, a growing trend in advanced cyber threats.
Credential Theft and Lateral Movement
With security defenses neutralized, attackers move quickly to extract sensitive information. They use built-in Windows tools to dump credentials from the LSASS process, gaining access to user passwords and authentication tokens.
From there, they attempt lateral movement across the network using tools like NetExec. This behavior strongly indicates that the attackers are not just targeting individual systems but are aiming for broader network compromise.
Such actions are often associated with initial access brokers, who specialize in infiltrating networks and then selling access to ransomware groups or other malicious actors.
Indicators of Organized Cybercrime Activity
Interestingly, researchers discovered Russian-language comments embedded within related infrastructure, including fake Google Chrome update pages. While not definitive proof, these clues suggest a possible geographic origin or developer background.
Combined with the level of sophistication observed, this campaign appears to be the work of organized cybercriminal groups with significant resources and technical expertise.
Defensive Measures for Organizations
To mitigate this threat, organizations must adopt proactive monitoring strategies. This includes identifying unauthorized installations of remote access tools like ScreenConnect and closely examining any unexpected kernel drivers loaded from temporary directories.
Endpoint security solutions should be configured to detect abnormal driver behavior, and system administrators should enforce strict controls over driver installations. User awareness also plays a critical role, as many attacks begin with simple social engineering tactics.
What Undercode Say:
The campaign described here is not just another phishing attempt; it represents a shift toward hybrid attack models that combine psychological manipulation with deep technical exploitation. The use of tax-related lures is particularly effective because it targets a moment when users are already under pressure and more likely to act quickly without scrutiny.
One of the most concerning aspects is the integration of malvertising with advanced post-exploitation techniques. Traditionally, malvertising campaigns focused on delivering basic malware or adware. In this case, it acts as the entry point for a highly coordinated, multi-stage intrusion that can dismantle enterprise-grade defenses.
The FatMalloc crypter stands out as a clever evolution in evasion tactics. Instead of relying solely on obfuscation or encryption, it manipulates system resources to disrupt security analysis. This reflects a deeper understanding of how modern antivirus engines operate and how they can be bypassed through non-traditional means.
Equally alarming is the use of a legitimate Huawei driver in the BYOVD attack. This technique underscores a fundamental weakness in trust-based security models. Even signed drivers from reputable vendors can become weapons if vulnerabilities are discovered and exploited. It raises important questions about how hardware and software vendors manage and revoke compromised components.
The attackers’ persistence strategy also deserves attention. By deploying multiple remote access tools simultaneously, they create a resilient foothold that is difficult to eradicate بالكامل. This redundancy mirrors tactics seen in advanced persistent threat groups, suggesting a convergence between cybercrime and state-level methodologies.
Another key insight is the rapid transition from access to exploitation. Once inside, the attackers waste no time disabling defenses and harvesting credentials. This efficiency indicates automation and pre-planned workflows, which can significantly reduce the window for detection and response.
From a broader perspective, this campaign highlights the growing role of initial access brokers in the cybercrime ecosystem. These actors specialize in breaching networks and then monetizing that access, often by selling it to ransomware operators. It creates a modular attack economy where different groups handle different stages of the intrusion.
Organizations must rethink their defensive posture in light of these developments. Traditional perimeter defenses are no longer sufficient. Instead, there must be a focus on behavior-based detection, zero-trust architectures, and continuous monitoring of system activity.
User education also remains a critical line of defense. Even the most advanced security systems can be undermined by a single careless click. Training users to recognize suspicious ads and verify sources can significantly reduce the risk of initial compromise.
Finally, collaboration between security vendors, researchers, and organizations is essential. Sharing threat intelligence in real time can help identify and disrupt campaigns before they reach a critical scale. Without such cooperation, attackers will continue to exploit gaps in visibility and response.
Fact Checker Results
✅ The attack uses fake W-2/W-9 ads to distribute malware, consistent with reported malvertising tactics.
✅ BYOVD techniques exploiting signed drivers are a known and growing cybersecurity threat.
❌ Direct attribution to a specific country remains inconclusive despite language clues in the code.
Prediction
🔮 Malvertising will increasingly evolve into a primary entry point for advanced cyberattacks, not just simple scams.
⚠️ More attackers will adopt BYOVD techniques as driver vulnerabilities continue to surface.
🚨 Tax season and similar high-pressure periods will remain prime targets for large-scale social engineering campaigns.
🕵️📝✔️Let’s dive deep and fact‑check.
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.quora.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
Bing
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon
