How a Tax Search Leads to Kernel-Mode AV/EDR Kill

What it is

A retrospective analysis by Huntress Tactical Response of a malvertising campaign delivering a BYOVD EDR killer via rogue ScreenConnect installers. The summary covers the actor and technique; this document carries the concrete IOCs and detection signals the summary omits.

How it works

The redirect chain is specific: a Google Ads click for "W2 tax form" / "W-9 Tax Forms 2026" lands on anukitax[.]com/forminw9/, which redirects to bringetax[.]com/humu/ — the actual rogue ScreenConnect delivery page. Payloads (both the tax lure and the separate fake-Chrome-update lure at grinvan[.]com/vims/browser/) are hosted on 4sync, a file-sharing platform.

The fake Chrome update instructs the victim to "unzip updater.zip and run updater.exe." Its JavaScript fetches the victim's IP and geolocation via ipapi.co and pushes a real-time notification (IP, country, referring URL) to the operator's Telegram bot; the payload is delivered silently through a hidden iframe to a 4sync direct-download link.

Cloaking is two-layer: JustCloakIt server-side + Adspect client-side. Adspect is a commercial service marketed at $299/month with "no content rules" — which is why Google reviewers, scanners, and researchers all see a clean page while only real victims on real hardware get the payload.

Preconditions / Affected

U.S.-based users searching for tax forms during filing season (April 15 deadline). Huntress reported over 60 instances of rogue ScreenConnect sessions tied to this campaign as the initial access vector across its customer base.

What to do

The strongest defensive signal the page gives is RMM stacking as a persistence tell:

• Treat multiple ScreenConnect relay instances on one host (the campaign consistently deployed two or three relays per host) plus backup RMM like FleetDeck appearing within hours as attacker redundancy, not user convenience — hunt for it even if one relay is remediated.
• Block/alert on the delivery domains anukitax[.]com, bringetax[.]com, grinvan[.]com and downloads from 4sync.
• Flag updater.zip / updater.exe from browser-update prompts and outbound calls to ipapi.co followed by Telegram API traffic on user endpoints.
• Because remediation must survive partial cleanup, remove all relays, not the first one found.

Caveats

This is retrospective threat hunting — at analysis time the delivery page was no longer serving payloads; findings came from the actor's left-open directory. The pre-ransomware/IAB end goal is Huntress's assessment based on a second intrusion (LSASS dumping, NetExec lateral harvesting), not confirmed ransomware deployment. The Russian-speaking-developer attribution rests on JavaScript comments. The specific Huawei driver is described as previously undocumented but is not named in this excerpt.