# DriveSurge: A Year-Long Malware Campaign Hijacking Thousands of Legitimate Sites
Researchers have uncovered a sophisticated and wide-scale malware distribution operation dubbed DriveSurge that compromised thousands of legitimate websites to deliver ClickFix and FakeUpdate malware attacks. Operating undetected for nearly a year, the campaign functions as a mature initial access broker (IAB) ecosystem, selling victim leads to downstream threat actors through a pay-per-install (PPI) model. The operation's scale and technical sophistication signal a troubling shift toward industrialized malware delivery infrastructure.
## The Threat
DriveSurge represents a particularly insidious attack vector: rather than targeting organizations directly, the operation weaponizes the trust users place in legitimate websites. Researchers at Silent Push discovered that threat actors hijacked thousands of high-reputation websites using a technique called traffic distribution systems (TDS) to silently redirect unsuspecting visitors to malware delivery sites.
The operation delivers two primary malware families:
What distinguishes DriveSurge from typical drive-by download campaigns is its dual-platform targeting. The operation doesn't limit itself to Windows systems—it actively targets macOS users as well, broadening its potential victim pool significantly. This cross-platform approach indicates attackers are either selling leads to multiple criminal groups or operating a more diversified malware-as-a-service (MaaS) ecosystem.
## Background and Context
The operation leverages an open-source traffic distribution system called zTDS, which has been publicly available since at least 2015 at ztds[.]info. While zTDS itself is legitimate technology used for performance testing and legitimate ad distribution, DriveSurge weaponizes it by deploying the system across compromised websites to redirect traffic without site owners' knowledge or consent.
This represents a critical supply-chain compromise at scale. The websites hijacked by DriveSurge weren't breached through sophisticated zero-days or advanced persistent threat (APT) tactics—many likely fell victim to credential theft, unpatched vulnerabilities, or misconfigured access controls. Once compromised, these sites became unwitting distribution nodes for malware, leveraging their existing user traffic and domain reputation to bypass security controls.
The operation's IAB model is crucial to understanding its business structure:
| Aspect | Details |
|--------|---------|
| Primary Role | Initial Access Broker |
| Business Model | Pay-Per-Install (PPI) |
| Victims Supplied | Compromised systems with initial access |
| Downstream Buyers | Ransomware operators, data thieves, APT groups |
| Scale | Thousands of hijacked sites |
| Duration | Approximately one year (undetected) |
As an IAB, DriveSurge's value lies not in direct exploitation but in identifying and compromising systems that larger criminal operations can then penetrate. A ransomware gang or data exfiltration crew pays for access to already-compromised machines, dramatically reducing their own reconnaissance and initial foothold costs.
## Technical Details
### Traffic Redirection Infrastructure
DriveSurge's technical architecture is remarkably sophisticated, featuring multiple layers of obfuscation and redundancy:
Compromised Site Injection: The attackers inject code into legitimate websites that references zTDS domains. When a visitor arrives at a hijacked site, invisible JavaScript redirects them to attacker-controlled infrastructure. The victim never sees the redirect—they're simply forwarded to a malware delivery page while believing they're still on the original site.
Obfuscation Techniques: Silent Push researchers identified several evasion methods employed across the campaign:
### Infrastructure Components
The operation maintains an extensive backend infrastructure designed for resilience:
### Victim Profiling
A particularly notable aspect of DriveSurge's operation is its victim profiling capability. Before delivering the final malware payload, the infrastructure executes an obfuscated profiling script that gathers extensive environmental data:
This profiling allows attackers to selectively target high-value victims—systems running outdated security software or lacking protections become priority delivery targets. Systems with robust endpoint protection are potentially skipped, ensuring more efficient resource allocation and lower detection risk.
## Implications for Organizations
The DriveSurge campaign highlights several critical security gaps affecting organizations across sectors:
### Website Security Remains a Weak Link
Many organizations don't adequately monitor their web properties for unauthorized modifications. Compromised websites that inject zTDS redirects won't immediately cause obvious failures—legitimate users can still access the site, but attackers intercept a percentage of traffic. This "silent compromise" can persist for months without internal detection.
### Supply-Chain Abuse at Internet Scale
The campaign demonstrates how legitimate open-source tools (zTDS) can be weaponized at massive scale. An IAB operation that compromises thousands of websites essentially transforms the public internet into a malware delivery network, exploiting the trust relationship between users and established domains.
### Third-Party Risk is Growing
Organizations rely on countless third-party websites, plugins, ads, and integrations. If any of these services become compromised, they become conduits for attack. DriveSurge proves that attackers view the supply chain not as a target but as infrastructure.
## Recommendations for Defense
Organizations should implement a layered defense strategy:
For Website Operators:
For All Organizations:
For Security Teams:
## HackWire Analysis
DriveSurge represents a fundamental shift in malware distribution economics: instead of competing for zero-days or relying on user susceptibility to phishing, modern IAB operations simply scale compromise across legitimate infrastructure. A year of undetected activity across thousands of websites suggests defenders are losing the measurement game—attackers are moving faster than detection can keep pace.
The dual-platform targeting also deserves attention. macOS has historically received less scrutiny from malware developers, partly due to perceived security-through-obscurity. DriveSurge's decision to target Apple users signals that macOS is no longer niche enough to ignore. Enterprise teams that assumed Mac endpoints required less aggressive endpoint detection will need to recalibrate.
What's most striking is the operational maturity visible in the infrastructure design. This isn't script-kiddies running commodity tools—the profiling logic, redundancy architecture, and obfuscation techniques all suggest professionals with deep malware development experience. The fact that they chose the IAB model rather than direct ransomware deployment indicates a strategic focus on volume and sustainability over quick paydays. DriveSurge appears designed to operate indefinitely, not to burn out in one explosive campaign.
For defenders, the lesson is clear: website compromise is no longer a niche problem for web admins. It's a supply-chain compromise vector with enterprise-wide implications. Organizations need to treat their web properties with the same rigor they apply to endpoints—because in the DriveSurge model, a compromised website becomes a persistent backdoor to customer devices.
— *HackWire Editorial*
## Related Coverage