In an astonishing act of financial creativity that rivals offshore accounts and shell companies, a new malware campaign is targeting U.S.-based tax filers just trying to get a handle on their IRS headaches. Scammers are cunningly using Google Ads, proving once again that if you can’t trust the Internet, at least you can trust it to deliver irony in high definition.

The scam presents itself with the subtlety of an office lunch thief, dressing up as legitimate tax document searches while actually serving up rogue installers for ConnectWise ScreenConnect. Think of it as a secret ingredient in your tax-filing soup, but instead of flavor, you get a side of panic and compromised data.

But wait, there’s more! The malvertisers have thrown in a little extra razzle-dazzle with a tool called HwAudKiller. This digital ninja moves in the shadows to disable security programs, utilizing the ever-popular BYOVD technique. Why have a baked-in vulnerability when you can bring your own, right? It’s the cybersecurity equivalent of installing your own trapdoor in a bank vault.