DriveSurge Threat Actor Exploits ClickFix and Fake Updates to Infect Websites

Key Takeaways

• The DriveSurge threat actor operates as an Initial Access Broker (IAB), monetizing infections through a Pay-Per-Install (PPI) model.
• DriveSurge compromises thousands of websites, redirecting visitors to malware via convincing fake browser updates and “ClickFix” prompts.
• The campaign targets a broad spectrum of browsers across both Windows and macOS platforms.
• The threat actor employs sophisticated obfuscation and a robust traffic distribution system (TDS) with failover mechanisms to ensure payload delivery.

DriveSurge Threat Actor Uses ClickFix and Fake Updates to Infect Websites

Recent investigations have identified DriveSurge as a specialized Initial Access Broker (IAB) that profits from a Pay-Per-Install (PPI) scheme. This group is paid for each successful device infection, subsequently selling these verified leads to other downstream threat actors.

Researchers have meticulously mapped out DriveSurge’s malicious infrastructure, detailing eight distinct technical signatures. These fingerprints range from the methods used to inject scripts into victim websites to the domain registration patterns employed by the group.

The intricate operational details suggest that DriveSurge has invested considerable effort into developing a highly scalable and repeatable infection system. The group has successfully compromised thousands of websites, silently redirecting unsuspecting visitors to malware without the site owners’ knowledge.

The campaign exhibits a wide targeting scope, impacting numerous popular browsers including Google Chrome, Mozilla Firefox, Microsoft Edge, Safari, Opera, Brave, Yandex, Vivaldi, Samsung Internet, and UC Browser.

Victims are typically confronted with either a deceptive browser update page or a “ClickFix” prompt. Both are meticulously designed to appear legitimate and routine, leveraging user familiarity to enhance their effectiveness against unsuspecting individuals.

Infection Methods: Fake Updates and ClickFix

DriveSurge primarily employs two deceptive strategies to coerce users into installing malware. In the “Fake Update” scenario, a compromised website presents a highly convincing browser update notification, impersonating a well-known browser.

Clicking the “update” button initiates the download of a ZIP archive. This archive contains multiple DLL files along with an executable named “Browser Update.exe,” which is, in fact, malware.

The “ClickFix” method operates differently. It displays a fabricated error message instructing the victim to copy and paste a specific command into their terminal or PowerShell window. Executing this command silently installs malware onto the system. In one documented instance, a ClickFix prompt attempted to retrieve malicious code from an IP address already flagged in active threat intelligence feeds. Both techniques exploit the inherent trust users place in familiar online interfaces and routine system prompts.

The underlying zTDS (zero-tolerance traffic distribution system) infrastructure employs advanced obfuscation techniques, such as Base64 encoding and string manipulation, to conceal malicious redirect code within seemingly innocuous page elements. A sophisticated failover mechanism cycles through multiple backup servers, ensuring that the payload reaches the victim even if a primary delivery domain becomes unavailable. Researchers have confirmed that this TDS has been actively operational since at least 2022.

MacOS Targeting and Cross-Platform Strategy

Analysis of obfuscated JavaScript files linked to DriveSurge has revealed that the attack chain extends beyond Windows machines. One identified payload was specifically designed to deliver macOS malware, indicating DriveSurge’s proactive efforts to build a cross-platform victim base.

The macOS payload utilized a multi-stage shell command to download and execute a secondary file, subsequently self-deleting to minimize forensic traces.

Researchers also uncovered a distinct Advertisement Distribution System (ADS) associated with the campaign. This system gathers device metadata and employs behavioral signals, such as mouse movements, scrolls, and clicks, to confirm human interaction before delivering content.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Educate Users: Train employees to recognize fake browser update prompts and suspicious “fix” instructions. Emphasize never running commands from untrusted sources.
• Monitor for Injections: Implement robust monitoring for unusual external JavaScript injections on your websites. Regularly audit third-party scripts loading from unfamiliar domains.
• Patch and Secure CMS: Ensure all web-facing Content Management Systems (CMS) and their plugins are fully patched and configured with strong access controls.
• Implement Ad Blockers/Security Software: Deploy enterprise-grade ad blockers and endpoint detection and response (EDR) solutions that can detect and block malicious redirects and downloads.
• Network Segmentation: Segment networks to limit the lateral movement of malware in case of an infection.
• Review Logs: Regularly review web server and proxy logs for connections to known malicious domains and IP addresses, including the Indicators of Compromise (IoCs) provided above.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.