DriveSurge Hijacks Thousands of Websites for ClickFix and FakeUpdate Malware Campaigns
What Happened – The threat actor known as DriveSurge has compromised thousands of legitimate, high‑reputation websites and is using them to serve two social‑engineering payloads: “ClickFix” PowerShell command injections and “FakeUpdate” bogus browser‑update prompts. Visitors are silently redirected through the open‑source traffic distribution system (zTDS) to the most appropriate lure, delivering Windows or macOS malware.
Why It Matters for TPRM –
- Compromised third‑party sites become a covert attack vector against your employees, customers, and partners.
- The pay‑per‑install model expands the threat quickly, increasing the likelihood of exposure for any organization that references or embeds external content.
- Traditional perimeter defenses may miss the malicious redirects because the hosting domains appear legitimate.
Who Is Affected – All industries that host public‑facing web properties or embed third‑party widgets, including technology SaaS, e‑commerce, financial services, healthcare, government, and media.
Recommended Actions –
- Conduct a review of all third‑party web assets and embedded scripts for unauthorized JavaScript injections.
- Enforce strict content‑security policies (CSP) and subresource integrity (SRI) for external resources.
- Educate users to verify software updates only via native application menus, not browser prompts.
- Deploy web‑gateway or DNS filtering that blocks known zTDS domains and suspicious “t.js” patterns.
Technical Notes – DriveSurge leverages the open‑source zTDS traffic distribution system (in use since 2015) to profile visitors and serve either a ClickFix PowerShell command or a FakeUpdate download. The ClickFix payload hijacks the clipboard and executes PowerShell commands; the FakeUpdate payload mimics updates for Chrome, Firefox, Edge, Safari, Opera, Brave, Yandex, Vivaldi, Samsung Internet, and UC Browser, delivering a ZIP of DLLs and a malicious executable. The campaign also includes an obfuscated JavaScript targeting macOS. Source: BleepingComputer