DriveSurge Threat Actor Compromises Thousands of Sites for ClickFix and Fake Update Malware Delivery

Du'aine Davis

Observed in the wild

• On 30 May, Silent Push reported a new threat actor, DriveSurge, compromising thousands of legitimate websites and using them to redirect visitors to malware. The affected sites include business, professional-services and local-organisation websites. Silent Push assesses DriveSurge likely acts as an initial access broker, selling successful infections to other threat actors.
• DriveSurge compromises trusted websites to make its lures appear legitimate. Visitors are silently profiled, then shown either fake browser update prompts or ClickFix-style messages telling them to paste a “fix” into PowerShell or Terminal. The campaign targets both Windows and macOS users, with observed payloads including fake update executables and malicious command-line downloads.
• Organisations should look for users visiting compromised sites followed by suspicious browser-led activity, especially browsers launching PowerShell, Terminal, curl, bash or encoded commands. In Microsoft Defender, investigate fake update downloads, command-line execution after browser activity, and known DriveSurge indicators. User guidance should specifically warn against pasting browser “fixes” or update commands into command shells.

Meet DriveSurge: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites - Silent Push