Loading story…
A large-scale malvertising campaign used Google Ads and fake tax-form websites to target U.S. users searching for W-2 and W-9 documents, redirecting victims through domains such as anukitax[.]com and bringetax[.]com to download a rogue ScreenConnect MSI. Huntress said the activity has been active since at least January 2026 and identified more than 60 rogue ScreenConnect sessions across its customer base. The operation used cloaking services including Adspect and JustCloakIt to evade ad reviewers and researchers, and the same infrastructure also supported a fake Google Chrome update lure.
After gaining remote access, the attackers deployed the FatMalloc crypter, installed FleetDeck for redundant persistence, and launched HwAudKiller, a bring-your-own-vulnerable-driver tool that abused a signed Huawei audio driver to terminate security products from kernel mode. Huntress reported the malware disabled defenses including Windows Defender, Kaspersky, and SentinelOne, then dumped LSASS credentials and used NetExec for account harvesting across victim networks. The intrusion pattern was assessed as consistent with ransomware staging or initial access brokerage, and exposed infrastructure containing Russian-language JavaScript comments and Telegram-based victim notifications suggested a broader toolkit operated by a likely Russian-speaking developer.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
On March 19, 2026, Huntress publicly documented the tax-themed malvertising operation, including its use of Adspect and JustCloakIt for cloaking, the FatMalloc crypter, and the HwAudKiller EDR killer. The report also noted fake Chrome update lures, Telegram-based victim notifications, shared 4sync infrastructure, and Russian-language code comments suggesting a likely Russian-speaking developer.
Across its customer base, Huntress identified more than 60 rogue ScreenConnect sessions associated with the campaign, often with redundant relays and FleetDeck persistence. In at least one intrusion, the attackers disabled products including Windows Defender, Kaspersky, and SentinelOne, dumped LSASS credentials, and used NetExec for account harvesting, behavior consistent with ransomware staging or initial access brokerage.
Victims who followed the tax-themed lures were redirected through domains such as anukitax[.]com and bringetax[.]com to install a rogue ScreenConnect MSI, giving attackers remote access. The intrusion chain then deployed FatMalloc, FleetDeck, and HwAudKiller, a BYOVD payload abusing a signed Huawei audio driver to terminate security tools from kernel mode.
By at least January 2026, a large-scale campaign was active that targeted U.S. users searching Google for W-2 and W-9 tax forms. The operation used Google Ads, cloaking services, and fake tax-themed websites to redirect victims toward malicious downloads.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 26 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple U.S.-focused phishing campaigns that used **tax-themed lures** to trick victims into opening password-protected ZIP archives and malicious Windows shortcut (`.lnk`) files. Microsoft said the activity targeted accounting, tax preparation, CPA, bookkeeping, and financial services firms, with emails posing as client tax documents and using AWS click-tracking links at `awstrack[.]me` to redirect users to hosted ZIP files. Securonix separately described a related campaign it tracks as **TACTICAL#OCTOPUS**, which used similar tax-season themes and staged lure PDFs to infect victims. The infection chains relied on `.lnk` files to launch PowerShell and VBScript, retrieve additional MSI, DLL, EXE, and PDF payloads, and in some cases use **GuLoader/CloudEyE** to execute shellcode and deliver **Remcos** or other malware directly in memory. Securonix said newer samples shifted from encoded IP-based URLs to public redirect services such as `rebrand.ly`, while payloads used process injection into Internet Explorer utilities including `ieinstal.exe` and `ielowutil.exe` to evade detection. Researchers said the resulting compromises enabled remote access, keystroke logging, clipboard capture, information theft, and potential lateral movement, with observed command-and-control infrastructure including `5.8.8.100`, `109.206.240.67`, and `194.180.48.211`.
Aug 15, 2026
Multiple active malware campaigns are abusing *trusted distribution channels*—including Chrome/Edge extensions, Visual Studio Code extensions, and Google Ads/redirection infrastructure—to trick users into executing payloads that deliver **remote access trojans (RATs)** or **information stealers**. Huntress reported a malvertising-driven fake ad blocker extension, **NexShield**, that intentionally forces Chrome/Edge into a crash/DoS state by looping `chrome.runtime` port connections; on restart it displays a fake “security warning” and uses a **ClickFix-style** social engineering flow (“CrashFix”) to push users to paste and run clipboard-copied commands that trigger an obfuscated PowerShell download-and-execute chain, ultimately deploying the Python-based **ModeloRAT** in corporate environments. Separately, Trend Micro described **Evelyn Stealer** delivered via a trojanized **Visual Studio Code extension** that drops a malicious `Lightshot.dll` side-loaded by legitimate *Lightshot* (`Lightshot.exe`), then runs staged PowerShell and payload retrieval to steal browser credentials, cookies, crypto wallets, VPN/Wi‑Fi data, files, and screenshots before exfiltrating to an attacker-controlled FTP server—posing elevated risk when developer workstations are compromised. South Korea-focused activity also features prominently across several reports, with multiple delivery vectors leading to RAT deployment. ASEC documented **Remcos RAT** distributed via fake installers masquerading as *VeraCrypt* and via gambling-related “lookup” tools, using multi-stage obfuscated **VBS/PowerShell** chains and enabling credential theft, keylogging, and device surveillance (webcam/mic). Genians attributed “**Operation Poseidon**” to the **Konni APT**, describing spear-phishing that abuses Google’s advertising/tracking redirection (e.g., `ad.doubleclick.net` parameters) to make malicious links appear legitimate, redirecting victims to compromised WordPress infrastructure hosting ZIPs with LNK files that launch AutoIt-based loaders to run an **EndRAT** variant in memory. Nextron Systems reported widespread trojanized “free converter” apps promoted via malicious Google ads and lookalike converter sites (e.g., `ez2convertapp[.]com`, `convertyfileapp[.]com`), with some payloads signed using abused/rotating code-signing certificates (e.g., BLUE TAKIN LTD, TAU CENTAURI LTD, SPARROW TIDE LTD) to evade trust checks while installing persistent backdoors.
Jun 29, 2026
Attackers distributed remote-access malware through two distinct delivery chains: a fake **FileZilla** website serving trojanized installers and phishing emails impersonating South Korea’s **National Tax Service**. In the FileZilla campaign, victims received either a portable archive containing a malicious `version.dll` for DLL sideloading or a bundled installer that deployed legitimate FileZilla alongside a rogue DLL in the install path. The malware acted as a multi-stage loader, decrypting payloads in memory before launching a RAT that could steal credentials, log keystrokes, capture screenshots, and provide **HVNC**-based remote control. The operators also used DNS-over-HTTPS to Cloudflare’s resolver to look up `welcome.supp0v3[.]com`, likely to reduce visibility to DNS-based defenses, and included anti-analysis checks for VMware and VirtualBox environments. In the tax-themed campaign, recipients were lured to spoofed tax-notice pages and prompted to download a ZIP archive containing a legitimate signed Intel executable, a malicious sideloaded DLL, and an encrypted `BIN` payload. The malware decrypted shellcode and a RAT/backdoor from `vulkan-1.bin` using a modified RC4 routine, then established persistence through a service named **"Microsoft Compatibility system"**. Researchers said the backdoor supports remote control, privilege escalation, process injection, file theft, and lateral movement over RPC. Infrastructure analysis linked the activity to multiple variants and multilingual lures, including impersonation of tax and court authorities in Malaysia and India, indicating an organized, evolving multi-country operation.
Jun 29, 2026