Malware - Trojanized ConnectWise ScreenConnect Attack Uncovered

What Happened

A new malvertising campaign has emerged, targeting individuals in the U.S. with trojanized ConnectWise ScreenConnect installers. This campaign has been ongoing since January and exploits searches for tax-related documents. By using Google Ads, attackers serve sponsored results for terms like "W2 tax form" or "W-9 Tax Forms 2026," redirecting users to fake websites.

Once on these sites, users unknowingly download the compromised installers. These installers facilitate a bring your own vulnerable driver attack, allowing attackers to gain deeper access to the victims' systems. The malicious software is designed to launch various trial instances on the targeted device, setting the stage for further exploitation.

Who's Being Targeted

The campaign primarily targets individuals searching for tax forms, a common activity during tax season. The sophistication of this attack is alarming, as it illustrates how cybercriminals are increasingly using commodity tooling to lower the barrier for executing complex attacks. This means that even those with limited technical skills can launch effective cyber operations.

As tax season approaches, many people are likely to be searching for these documents, making them prime targets for this campaign. The attackers are leveraging the urgency and necessity of tax filing to lure victims into their trap.

Signs of Infection

Victims of this campaign may notice unusual behavior on their devices after downloading the trojanized installers. One significant sign is the presence of the HwAudKiller, an EDR killer that targets security solutions like Microsoft Defender, SentinelOne, and Kaspersky. This malicious tool exploits a vulnerable Huawei driver to disable these protective processes, leaving the system exposed.

If users experience unexpected crashes, slow performance, or find that their security software is disabled without explanation, these could be indicators of infection. It's crucial for users to remain vigilant and monitor their systems for any signs of compromise.

How to Protect Yourself

To safeguard against such attacks, users should take proactive measures. Here are some recommendations:

• Verify Sources: Always ensure that you are downloading software from official websites or trusted sources.
• Use Security Software: Keep your antivirus and anti-malware software updated to detect and block threats.
• Educate Yourself: Be aware of common phishing tactics and malvertising campaigns, especially during tax season.
• Monitor System Behavior: Regularly check your device for unusual activity or performance issues.

By being cautious and informed, users can significantly reduce their risk of falling victim to these sophisticated malware campaigns.