DriveSurge Uses ClickFix and Fake Browser Updates to Broker Malware Access

Researchers identified DriveSurge as a large-scale threat actor operating as an apparent initial access broker, compromising legitimate websites and redirecting visitors into ClickFix and fake browser update infection chains. The operation uses the open-source zTDS traffic distribution system to profile victims, selectively route traffic, and deliver malware across Windows and macOS environments. Investigators linked the campaign to thousands of compromised sites, NiceNIC-registered domains, Russian-linked infrastructure patterns, multiple payload servers, and a command-and-control endpoint, indicating a mature pay-per-install ecosystem built to provide downstream actors with scalable victim access.

Silent Push said it developed eight infrastructure fingerprints spanning malicious JavaScript injections, server configurations, WHOIS pivots, and zTDS artifacts to map both active and pre-weaponized infrastructure. The campaign has reportedly been active since at least 2022, using obfuscation, failover delivery paths, ZIP-based fake updates, and terminal- or PowerShell-driven ClickFix lures to infect users across major browsers. Researchers urged defenders to hunt for unauthorized JavaScript on web properties, scrutinize third-party scripts from unknown domains, and harden internet-facing CMS platforms through patching and tighter access controls.