DriveSurge shows how ClickFix campaigns scale through compromised sites

At a glance

What this is: Silent Push documents DriveSurge as a large-scale ClickFix and FakeUpdates operation that abuses compromised websites, zTDS routing, and browser trust cues to deliver malware at scale.

Why it matters: This matters because the initial access path is no longer just phishing email or sprayed login pages. It now includes legitimate sites, browser update prompts, clipboard abuse, and identity-relevant trust signals that can bypass user suspicion and endpoint controls.

Context

ClickFix is a social-engineering delivery pattern that persuades a user to paste or run a malicious command, often by disguising it as a verification or repair step. In this report, Silent Push shows how that tactic is being industrialised through compromised websites and traffic distribution infrastructure, turning trust in ordinary browsing into a malware delivery channel.

The identity angle is indirect but real: when a user follows a fake browser update or clipboard prompt, the attacker is not just stealing a session. The attacker is manipulating a trust decision at the point where human identity, device access, and browser-mediated authentication all intersect.

Key questions

Q: What breaks when trusted websites are used to deliver malware through fake updates?

A: Reputation-based trust breaks first. A legitimate site can carry injected code, so users see a familiar domain while the actual delivery happens through hidden redirects and browser prompts. That makes traditional blocklists and user awareness alone insufficient. Teams need telemetry on script provenance, redirect chains, and endpoint execution because the compromise begins inside a trusted session, not on a clearly malicious landing page.

Q: Why do fake browser update prompts and ClickFix flows remain effective?

A: They work because they convert routine user behaviour into execution. The prompt looks like maintenance or verification, so the victim acts before suspicion rises. That removes the need for an exploit in many cases and shifts the attacker’s burden to social engineering and delivery infrastructure. Defenders should assume any browser-to-terminal handoff can be weaponised.

Q: How should security teams detect a campaign that uses a traffic distribution system?

A: Track the infrastructure, not just the payload. A TDS reveals itself through repeated script patterns, redirect chains, hosting regularities, and WHOIS pivots that link domains together. If teams only hunt on malware hashes or single domains, they miss the operator’s distribution logic. Pattern-based hunting is the better control because the infrastructure is what scales the campaign.

Q: What should teams do when a compromised site starts serving fake updates or terminal fixes?

A: Treat it as an incident involving both web compromise and endpoint exposure. Contain the affected site, block the delivery infrastructure, and review endpoints for downloaded archives, executed scripts, and persistence attempts. If the lure reached developer or admin users, widen the review to privileged workstations because the impact can quickly move from browser session abuse to broader compromise.

Technical breakdown

How compromised sites feed a traffic distribution system

DriveSurge does not rely on a single lure domain. It injects malicious resources into legitimate websites, then uses a traffic distribution system, or TDS, to decide which visitor should see which payload. That matters because the same infrastructure can sort by browser, user agent, referrer, geography, or other profile data before selecting a fake update page or a ClickFix flow. In practical terms, the attacker is using site compromise plus traffic steering to make detection harder and conversion more efficient. The result is a delivery layer that looks like normal web traffic until the last step, when the user is redirected into malware handling. See the Threat Hunting Guide. See the Threat Hunting Guide.

Practical implication: hunt for unexpected third-party script loads and redirect chains on legitimate sites before the final malware payload is served.

Why fake updates and ClickFix work together

FakeUpdates and ClickFix are complementary social-engineering paths. FakeUpdates asks the user to trust a browser-style prompt and install what looks like an update, while ClickFix pushes the user to execute a command that appears to repair a problem or complete a verification step. Both bypass the need for a traditional exploit by converting user action into code execution. The browser, terminal, and clipboard become the attack surface. In this campaign, the lures are diversified across many browser brands, which helps the operator match the prompt to the victim’s environment and reduce suspicion. That is a behavioural exploit, not just a payload delivery method. See the Phishing Guide. See the Phishing Guide.

Practical implication: treat browser-update prompts and copy-paste terminal instructions as high-risk execution events, not harmless nuisance alerts.

What infrastructure fingerprints reveal about operator maturity

The report shows a repeatable infrastructure pattern across domains, WHOIS pivots, server fingerprints, and externally loaded scripts. That is important because mature operators leave behind operational regularities even when they rotate domain names and payload servers. Reusable markers such as filename patterns, registrar choices, and server configuration become detection opportunities that outlast individual malicious domains. For defenders, this shifts the problem from blocking one domain to identifying a family of behaviours across web resources, hosting, and redirect logic. The strongest signal here is not a single indicator but the consistency of the infrastructure itself. See the Threat Intelligence Guide. See the Threat Intelligence Guide.

Practical implication: pivot from single-IOC blocking to pattern-based hunting across hosting, WHOIS, and web resource telemetry.

Threat narrative

Attacker objective: To turn compromised websites into a scalable initial-access service that infects victims and sells those infections downstream.

1. Entry occurs when a user visits a legitimate but compromised website that silently loads DriveSurge-controlled code through externally injected resources.
2. Credential_harvested is not the main step here; instead, the operator uses trust abuse and browser or terminal prompts to induce the user to run or install malware.
3. Escalation follows when the fake update or ClickFix flow delivers a ZIP file, DLLs, or a shell command that installs payloads and establishes command-and-control.
4. Impact is malware execution and downstream infection at scale, with DriveSurge acting as a lead generator for other threat actors.

Breaches seen in the wild

• Slack GitHub breach 2022: Slack employee tokens stolen via a compromised vendor were used to download private GitHub repositories over the 2022 holidays.
• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

DriveSurge is best understood as an initial-access supply chain, not a single lure campaign. The report describes a broker-like model that combines compromised sites, traffic steering, fake updates, and downstream delivery. That matters because it turns web compromise into a reusable service layer for other threat actors. Practitioners should treat this as a distribution ecosystem whose value lies in access conversion, not only payload execution.

ClickFix works because it collapses user trust, browser trust, and execution trust into one moment. A prompt that looks like a fix or verification step can persuade a user to paste code into a terminal without an exploit chain or credential theft first. This is where phishing guidance remains useful, but the control problem is broader than email security: the attacker is exploiting routine human workflow to obtain code execution. Practitioners should design controls that assume malicious instructions can arrive through any browser session.

Compromised-site delivery creates a governance gap that traditional perimeter thinking misses. The user starts from a legitimate domain, so allowlisting by reputation is not enough. The named concept here is trust-mirroring delivery: malicious code that borrows the look and context of ordinary browsing to make execution feel benign. Security teams should base response on script provenance, redirect behaviour, and endpoint execution events. Practitioners should hunt for where trusted context is being abused rather than only where malicious domains are known.

The infrastructure fingerprints matter more than the campaign branding. Domain patterns, WHOIS pivots, server signatures, and TDS behaviour create a repeatable detection surface that can be shared across teams and tooling. That is the kind of evidence that supports durable hunting rather than one-off blocklists. For defenders, the useful unit of analysis is the operator’s infrastructure logic, not the label attached to the cluster. Practitioners should promote these fingerprints into hunting hypotheses and detection content.

This campaign reinforces that identity and endpoint governance now overlap at the browser boundary. When fake updates and clipboard hijacking push a user toward terminal execution, the issue is no longer only endpoint hardening. It is also the governance of how trust is conferred inside everyday user workflows. Practitioners should treat browser-mediated execution as a controlled identity-adjacent event, especially where administrative or developer workstations are involved.

From our research library:

• 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
• Read next: Infostealer Threat Guide

What this signals

Trust-mirroring delivery: this campaign shows how attackers can borrow the credibility of legitimate sites and routine browser prompts to push users into executing malware. That shifts defensive focus toward script provenance, redirect telemetry, and endpoint execution signals rather than simple domain reputation.

DriveSurge also illustrates why browser boundary events deserve stronger governance in enterprise environments. When clipboard hijacking, fake updates, and terminal execution converge, the browser becomes a control point that sits between human intent and code execution, which means detection has to span web, identity, and endpoint telemetry.

For practitioners

• Hunt for injected web resources Look for unexpected externally loaded JavaScript, especially site-specific query strings, filename fingerprints, and redirect logic on otherwise legitimate websites.
• Block copy-paste execution paths Add detections for clipboard replacement, terminal launch from browser context, and users pasting commands that resolve to curl, bash, or base64 pipelines.
• Treat fake browser updates as execution events Escalate browser update prompts that lead to downloads of ZIP files, DLLs, or executables as malware delivery, not as nuisance pop-ups.
• Pivot on infrastructure fingerprints Use WHOIS pivots, registrar patterns, server headers, and TDS indicators to link domains into one campaign before you start containment work.
• Review exposure on high-trust sites Prioritise monitoring of partner, vendor, and local-service websites that could be compromised and used as redirectors into fake update chains.

Key takeaways

• DriveSurge uses compromised websites and traffic steering to convert normal browsing into a malware delivery path.
• The report’s fingerprints show that the campaign is operationally repeatable, which makes infrastructure pattern hunting more valuable than single-IOC blocking.
• Security teams should monitor injected scripts, fake update prompts, and clipboard-to-terminal execution paths as one connected attack surface.

Related NHI Mgmt Group resources: Phishing Guide · Infostealer Threat Guide · Threat Hunting Guide · Threat Intelligence Guide

Key terms

• ClickFix: A browser-delivered social engineering technique that persuades a user to paste and execute a malicious command, usually through clipboard manipulation and a fake instruction sequence. The key risk is that the endpoint may see a normal user action even though the payload originated from a hostile webpage.
• Traffic Distribution Service: A traffic distribution service is infrastructure that routes visitors through filtering, redirection, and landing-page logic before they reach a final payload site. Threat actors use it to hide destinations, block sandboxes, and deliver different content to different targets or geographies.
• Initial access broker: An initial access broker is an attacker or criminal intermediary that acquires footholds, such as stolen credentials, and then passes them to other threat actors. This role turns access into a commodity and increases the likelihood that simple credential exposure will become a broader breach.
• Trust-mirroring delivery: A malicious delivery pattern that borrows the context of a legitimate site, browser brand, or routine user action to make malware execution feel normal. The control problem is not just malicious infrastructure, but the abuse of familiar trust cues at the point of user action.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.