Tax Search Ads Deliver ScreenConnect Malware Using Huawei Driver to Disable EDR

Author: Ravie Lakshmanan
Date: Mar 24, 2026
Categories: Endpoint Security / Social Engineering

Cybercriminals are using malicious search advertisements for tax services to distribute ScreenConnect malware, leveraging a Huawei driver to disable endpoint detection and response (EDR) systems.

This attack campaign demonstrates how threat actors are exploiting seasonal search trends and legitimate software drivers to bypass security controls and establish persistent access to victim systems.