Loading story…
Researchers identified DriveSurge as a large-scale threat actor operating as an apparent initial access broker, compromising legitimate websites and redirecting visitors into ClickFix and fake browser update infection chains. The operation uses the open-source zTDS traffic distribution system to profile victims, selectively route traffic, and deliver malware across Windows and macOS environments. Investigators linked the campaign to thousands of compromised sites, NiceNIC-registered domains, Russian-linked infrastructure patterns, multiple payload servers, and a command-and-control endpoint, indicating a mature pay-per-install ecosystem built to provide downstream actors with scalable victim access.
Silent Push said it developed eight infrastructure fingerprints spanning malicious JavaScript injections, server configurations, WHOIS pivots, and zTDS artifacts to map both active and pre-weaponized infrastructure. The campaign has reportedly been active since at least 2022, using obfuscation, failover delivery paths, ZIP-based fake updates, and terminal- or PowerShell-driven ClickFix lures to infect users across major browsers. Researchers urged defenders to hunt for unauthorized JavaScript on web properties, scrutinize third-party scripts from unknown domains, and harden internet-facing CMS platforms through patching and tighter access controls.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A report described RedSun, tracked as CVE-2026-41091, as a local privilege escalation vulnerability in Microsoft Windows Defender's remediation workflow discovered by Nightmare Eclipse. The disclosure detailed how Cloud Files placeholders, NTFS junctions, Volume Shadow Copy detection, and oplocks could be combined to achieve arbitrary file writes into System32 and execute code as SYSTEM.
Silent Push reported that the infrastructure associated with the newly named DriveSurge threat actor has been active since at least 2022. The operation uses compromised websites and the zTDS traffic distribution system to redirect visitors into FakeUpdates and ClickFix malware delivery chains.
Silent Push disclosed a large-scale malware delivery operation it named DriveSurge, describing it as a specialized initial access broker using a pay-per-install model. The report linked the actor to thousands of compromised websites, zTDS-based redirection, malicious domains, payload infrastructure, and macOS as well as Windows malware delivery.
Avast Decoded published research on Lazarus and the FudModule rootkit, describing advanced exploits that went beyond bring-your-own-vulnerable-driver techniques and included an admin-to-kernel zero-day. This marks a public technical disclosure of the activity and tooling discussed in the report.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcescworld.com
Open sourcedarkreading.com
Open sourcemalware.news
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcesilentpush.com
Open sourcedecoded.avast.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that **ClickFix** has expanded into an industrialized malware-delivery ecosystem that relies on social engineering rather than software exploits. Attackers use fake CAPTCHA checks, browser updates, meeting errors, and verification prompts to trick users into manually running attacker-supplied commands through trusted tools such as PowerShell, `mshta`, `curl`, Windows Run, or macOS Terminal. ReversingLabs said the ecosystem now supports a wide range of payloads, including **Lumma Stealer**, **DarkGate**, **XWorm**, **AsyncRAT**, **NetSupport**, and **SectopRAT**, while related variants such as **CrashFix**, **FileFix**, **PromptFix**, and **ConsentFix** continue to emerge. The activity is being amplified through large-scale web compromise campaigns. Reports linked the **DriveSurge** actor to active **ClickFix** and **FakeUpdates** operations abusing thousands of compromised websites to distribute malware, while a separate SlowMist investigation documented a Google Sites-hosted phishing campaign targeting Web3 users on macOS with a fake community application flow that pushed victims to download a `.scpt` file or run a Base64-encoded Terminal command. That infection chain delivered a Mach-O stealer resembling **AMOS (Atomic macOS Stealer)**, which harvested browser credentials, cookies, Keychain data, Apple Notes, Telegram Desktop data, and cryptocurrency wallet files before archiving data to `/tmp/lksopo.zip` and exfiltrating it to `86.54.25.213`. Researchers said structural **YARA** detection of lure pages is currently one of the most effective ways to identify these campaigns, which often evade traditional AV and EDR controls because they depend on legitimate tools and user-approved execution.
Jul 18, 2026
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
Threat researchers reported continued evolution and operationalization of **ClickFix**-style social engineering, where victims are tricked into manually executing attacker-supplied commands via the Windows Run dialog. Huntress described a new variant dubbed **CrashFix**, attributed to **KongTuke**, which uses a **malicious browser extension** to display a fake “browser stopped abnormally” security warning and a bogus “scan” flow; the extension silently places a **PowerShell** command on the clipboard, disguised as a legitimate repair action, and instructs the user to paste-and-run it, leading to code execution. Rapid7 Labs separately documented a large-scale campaign in which an unidentified actor compromises legitimate **WordPress** sites to inject a ClickFix implant that impersonates a **Cloudflare human verification (CAPTCHA)** challenge. The operation has affected **250+** infected sites across **12+ countries** and delivers a **multi-stage, mostly in-memory** malware chain (obfuscated JavaScript → PowerShell stagers → in-memory loaders/shellcode) aimed at stealing **credentials and digital wallets** from Windows systems, enabling downstream financial theft and potential follow-on intrusion using harvested credentials.
Jun 29, 2026