DriveSurge’s ClickFix infrastructure: what practitioners need to watch

TL;DR: DriveSurge is driving a large-scale ClickFix and FakeUpdates ecosystem through thousands of compromised sites, using zTDS and other fingerprints to route victims into malware delivery and downstream infection chains, according to Silent Push research. The pattern shows how trust in familiar websites and routine browser prompts can be operationalised as an initial-access service, not just a one-off lure.

Editorial analysis by NHI Mgmt Group, based on content published by Silent Push: “Meet DriveSurge: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites”.

Key questions

Q: What breaks when trusted websites are used to deliver malware through fake updates?

A: Reputation-based trust breaks first.

Q: Why do fake browser update prompts and ClickFix flows remain effective?

A: They work because they convert routine user behaviour into execution.

Q: How should security teams detect a campaign that uses a traffic distribution system?

A: Track the infrastructure, not just the payload.

Practitioner guidance

• Hunt for injected web resources Look for unexpected externally loaded JavaScript, especially site-specific query strings, filename fingerprints, and redirect logic on otherwise legitimate websites.
• Block copy-paste execution paths Add detections for clipboard replacement, terminal launch from browser context, and users pasting commands that resolve to curl, bash, or base64 pipelines.
• Treat fake browser updates as execution events Escalate browser update prompts that lead to downloads of ZIP files, DLLs, or executables as malware delivery, not as nuisance pop-ups.

Bottom line: DriveSurge uses compromised websites and traffic steering to convert normal browsing into a malware delivery path.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →