# Thousands of Websites Compromised in Massive ClickFix and FakeUpdates Distribution Campaign


A sprawling malware distribution operation dubbed DriveSurge has silently compromised thousands of legitimate websites to redirect unsuspecting visitors into malware traps, according to new research from cybersecurity firm SilentPush. The campaign leverages two of the most effective social engineering techniques in the attacker's playbook—ClickFix and FakeUpdates—creating a sophisticated funnel that converts website visitors into infected endpoints.


The scale of the campaign is staggering: DriveSurge controls a traffic distribution system that profiles every visitor and determines which exploitation method has the highest success rate for that particular target. The result is a highly efficient malware distribution machine that operates on a pay-per-install model, selling access and infections downstream to other threat actors seeking initial network footholds.


## The Threat: Two Proven Deception Tactics


DriveSurge's arsenal consists of two well-established social engineering methods that continue to prove effective against both technical and non-technical users.


ClickFix attacks exploit user trust in system messages and supposed technical support. Victims are presented with fake error notifications that appear legitimate, urging them to copy and execute specific commands in the Windows Command Prompt or terminal to "resolve" the alleged issue. In reality, the commands deliver malware. The technique is particularly effective because it places responsibility for execution on the user, bypassing security controls that might block direct executable delivery.


FakeUpdates campaigns impersonate software update prompts, most commonly spoofing browser updates from Chrome, Firefox, Edge, Safari, Opera, Brave, Yandex, Vivaldi, Samsung Internet, and UC Browser. Users, conditioned to expect regular security updates, are tricked into downloading seemingly legitimate installers that contain malicious payloads. One case analyzed by SilentPush involved a fake Firefox update that delivered a ZIP archive containing multiple DLLs and an executable named "Browser Update.exe"—a file designed to appear authentic while establishing persistent infection.


What distinguishes DriveSurge's operation is the intelligent routing of victims. Not every user receives the same attack vector. The threat actor's traffic distribution system evaluates each visitor and selects the approach most likely to succeed, maximizing conversion rates and return on investment.


## Background and Context: Initial Access as a Service


DriveSurge operates primarily as an initial access broker (IAB), a specialized criminal role focused on gaining first-time entry into target networks rather than conducting the full attack. The group monetizes access through a pay-per-install (PPI) model, charging downstream customers—other cybercriminals conducting ransomware attacks, espionage operations, or data theft—for each successfully infected system.


This specialization reflects the maturation of the cybercriminal ecosystem. Rather than conducting end-to-end attacks themselves, sophisticated threat actors increasingly purchase access from specialists, compartmentalizing operations to reduce risk and increase efficiency. DriveSurge's ability to deliver thousands of infections reliably and cheaply makes them an attractive supplier in this underground marketplace.


The campaign centers on zTDS, an open-source traffic distribution system that has existed since at least 2015. DriveSurge adopted zTDS by September 2025, using it to silently redirect legitimate website traffic to malware-delivery infrastructure without the sites' owners or visitors being aware of the compromise.


"Using zTDS, DriveSurge hijacks thousands of legitimate, high-reputation websites and silently redirects visitors to malware, unbeknownst to the sites' owners or their visitors," SilentPush researchers documented. These are not small or obscure sites—the campaign targets high-reputation domains, meaning a visitor's trust in a site's legitimacy becomes a vulnerability that DriveSurge exploits.


## Technical Details: Infrastructure, Fingerprints, and Attribution


Researchers identified eight distinct technical fingerprints that distinguish DriveSurge's operations, enabling detection of both the group's infrastructure and compromised websites serving as distribution points.


JavaScript Injection Pattern: The most recognizable signature is a JavaScript injection following the pattern t.js?site=<id>, where <id> is a unique identifier assigned to each compromised website. This allows DriveSurge operators to track which sites are driving infections and optimize their operations.


Infrastructure Scale: SilentPush identified more than 80 malicious injection domains currently in active use, plus additional pre-weaponized domains not yet deployed. The breadth of infrastructure suggests long-term operational planning and significant resources dedicated to staying ahead of detection and takedown efforts.


Cross-Platform Capability: Perhaps most notably, researchers uncovered obfuscated JavaScript payloads specifically designed to target macOS systems. These payloads are delivered through verification-themed ClickFix attacks that exploit clipboard manipulation—a technique less commonly documented than Windows-focused attacks. This indicates DriveSurge is maximizing addressable targets across operating systems.


The attack flow operates as follows: A user visits a compromised website. They are immediately redirected through the zTDS system, which collects behavioral and technical signals about the visitor. Based on this profiling, the system determines whether a FakeUpdates or ClickFix lure is most appropriate. The victim is then redirected to the corresponding malware-delivery page.


## Implications: Scope and Risk


The campaign's scope presents risks across multiple constituencies:


Website Owners face compromised reputation, potential legal liability, and the resource cost of forensic investigation and remediation. Legitimate sites with strong reputation are particularly attractive to DriveSurge precisely because visitors trust them.


Individual Users and Organizations risk endpoint compromise, credential theft, lateral movement, and downstream attacks. Initial infections from PPI campaigns frequently lead to ransomware deployment or data exfiltration operations. Employees at organizations of any size could become attack vectors by visiting any of thousands of compromised sites during routine web browsing.


ISPs and Network Defenders must contend with a growing volume of malware traffic and the complexity of blocking distribution infrastructure while minimizing false positives.


The intelligence that DriveSurge collects during the profiling process—IP geolocation, operating system, browser type, and more—also provides threat actors insight into lucrative target profiles, potentially informing where downstream attacks concentrate.


## Recommendations: Defense and Awareness


For Individual Users:

  • Download software updates only through official channels. For browsers, use the built-in update mechanism (typically: About > Check for Updates) rather than responding to prompts encountered during normal browsing.
  • Never execute commands in the Command Prompt, Terminal, or PowerShell without fully understanding what they do. If a website prompts you to run a command, treat it as a red flag.
  • Keep security software updated and consider running periodic system scans.

    • For Organizations:

  • Conduct awareness training emphasizing the ClickFix and FakeUpdates tactics, using real examples from this campaign.
  • Implement endpoint detection and response (EDR) solutions that can identify suspicious command execution and unsigned binary launches.
  • Monitor outbound traffic for connections to known malware distribution domains. SilentPush's identified injection domains should be incorporated into network detection rules.
  • Ensure security team processes prioritize alerts related to browser update prompts and command execution from user sessions.
  • Review web browsing policies and consider restricting access to categories of sites with high compromise risk if feasible in your operational context.

    • For Website Administrators:

  • Conduct forensic analysis to determine compromise vectors and remediate root causes, not just remove malicious code.
  • Implement Web Application Firewalls (WAFs) with rules detecting malicious JavaScript injection patterns, particularly those matching the t.js?site=<id> signature.
  • Monitor integrity of JavaScript files and assets using file monitoring or integrity verification tools.

    • ---


    ## HackWire Analysis


    DriveSurge's campaign demonstrates a critical convergence: social engineering remains devastatingly effective precisely because it targets rational user behavior. A user downloading a browser update or responding to system errors isn't being foolish—they're performing expected maintenance. The threat actor's genius lies in weaponizing legitimacy itself.


    What makes this campaign particularly significant is the intersection of scale and sophistication. DriveSurge isn't just running a high-volume malware distribution racket; they're operating an intelligent targeting system. The zTDS profiling layer means that macOS users receive tailored attacks, Windows users receive different lures, and the system learns which approaches convert best for different profiles. This isn't spray-and-pray malware distribution—it's optimized conversion funnel engineering applied to cybercrime.


    The timing also matters. Browser security has improved significantly over the past decade, and browser vendors increasingly push updates through built-in mechanisms that circumvent user interaction. Yet FakeUpdates remain effective, suggesting that either these campaigns are reaching populations (or organizational environments) where security practices lag, or that the social engineering is simply that persuasive. Likely both.


    For defenders, the operational lesson is stark: initial access via social engineering remains cheaper and more reliable than exploiting zero-days. Organizations investing heavily in vulnerability management while neglecting user awareness and endpoint detection capabilities are misallocating resources. The DriveSurge infrastructure will be taken down, its domains sinkholed, and its zTDS instances identified. But the tactics—ClickFix and FakeUpdates—will continue because they work. New campaigns will emerge with the same methods.


    The defensive priority should be reducing the impact of successful infections. If DriveSurge succeeds in placing malware on a user's machine, can it move laterally? Can it escalate privilege? Can it phone home? These are the questions that distinguish organizations that suffer from initial compromises and those that suffer data breaches.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)