cyber.hendryadrian.com
Security News · bleepingcomputer.com

DriveSurge Uses Thousands of Hijacked Sites for ClickFix and FakeUpdates Campaigns

· Original article ↗

Summary

Silent Push says DriveSurge uses zTDS to route visitors of thousands of compromised sites to ClickFix or fake browser-update lures. Researchers also found a macOS-targeting JavaScript payload and recommend avoiding commands users do not understand.

Key points

  • Silent Push attributes campaigns affecting thousands of compromised websites to the DriveSurge threat actor.
  • The sites redirect visitors through zTDS, which profiles them and selects a ClickFix or FakeUpdates lure.
  • Fake updates impersonate browsers; ClickFix lures trick users into executing commands, including PowerShell.
  • Researchers described a fake Firefox update that downloaded a ZIP archive containing DLLs and a malicious executable.
  • Silent Push identified eight technical fingerprints and more than 80 malicious injection domains linked to the campaign.
  • Researchers also found an obfuscated JavaScript payload targeting macOS through verification-themed ClickFix lures that hijack the clipboard.
  • The article recommends updating browsers through their settings and avoiding commands users do not understand.

Article Details

Event Type
Large-scale malware-distribution campaign using compromised websites, ClickFix and FakeUpdates lures, and the zTDS traffic distribution system.
Impact
According to Silent Push researchers, thousands of legitimate websites were compromised and used to redirect visitors to malware. The campaign targets Windows and macOS users; reported lures include fake browser updates, malicious PowerShell commands, and a macOS-focused JavaScript payload. Silent Push describes DriveSurge as primarily operating as an initial access broker on a pay-per-install model, enabling follow-on attacks.

MITRE ATT&CK

T1059.001 · PowerShellThe ClickFix attacks involve victims being tricked into executing malicious PowerShell commands.T1204.002 · Malicious FileFake browser update lures prompt victims to download and install malicious payloads.T1204.004 · Malicious Copy and PasteClickFix lures trick victims into copying and executing malicious commands.

Threat Actors

DriveSurgeSilent Push researchers identify DriveSurge as operating large-scale malware-distribution campaigns through compromised websites using ClickFix and FakeUpdates lures. They describe the group as primarily functioning as an initial access broker on a pay-per-install model.

Tools

zTDSDriveSurge is running large-scale malware distribution campaigns through compromised websites using ClickFix and FakeUpdates lures, with visitors redirected by the zTDS traffic distribution system.