DriveSurge

DriveSurge is a large-scale malware distribution threat cluster assessed to operate primarily as a specialized Initial Access Broker using a pay-per-install model. The actor compromises legitimate websites and injects malicious code that silently redirects visitors to attacker-controlled infrastructure, allowing downstream operators to acquire victim access at scale. DriveSurge has been linked to widespread ClickFix and FakeUpdates campaigns and has abused thousands of compromised websites globally. The actor uses the open-source zTDS traffic distribution system to profile incoming visitors and selectively deliver social-engineering lures. Its FakeUpdates activity impersonates browser update prompts across multiple major browsers to induce victims to download and execute malware. Its ClickFix activity relies on fake verification or error dialogs that trick users into pasting attacker-supplied commands into PowerShell on Windows or Terminal on macOS. Researchers also observed clipboard hijacking and orchestrated multi-stage delivery flows designed to reduce visibility and improve execution success. DriveSurge targets both Windows and macOS users. Reported infrastructure and delivery patterns show emphasis on stealthy web-based initial access, malicious JavaScript injection, traffic filtering, redirect chains, and resilient failover mechanisms. The operation has been associated with multiple recurring infrastructure fingerprints, including distinctive injected script patterns, hashed JavaScript naming conventions, centralized domain-registration behaviors, and extensive use of traffic-distribution infrastructure. The campaign has also been tied to an advertisement-style distribution component that fingerprints users and verifies human interaction before serving malicious content. DriveSurge is notable for enabling follow-on compromise rather than being tied to a single malware family or extortion brand. Its core role is brokering access and distributing payloads for other threat actors through compromised web ecosystems. No high-confidence attribution to a nation-state is established in the available information.