{
  "name": "A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites",
  "slug": "a-new-threat-actor-using-clickfix-and-fake-update-drive-by-attacks-in-thousands-of-compromised-sites",
  "description": "DriveSurge is a newly identified threat actor operating as an Initial Access Broker using a Pay-Per-Install model to supply victim leads to downstream actors. The actor has compromised thousands of websites, injecting malicious code that redirects visitors through zTDS (Traffic Distribution System) to deliver malware via two primary methods: FakeUpdates, which impersonate browser update prompts for Chrome, Firefox, Edge, Safari, and eight other browsers; and ClickFix, which tricks users into executing malicious PowerShell commands disguised as fixes. DriveSurge leverages sophisticated infrastructure including bulletproof hosting, obfuscated JavaScript injection patterns, and environment-specific targeting including macOS systems. The operation has been active since at least September 2025, utilizing specific technical fingerprints including unique file naming conventions and server configurations that enable detection and tracking of their evolving infrastructure.",
  "published": "2026-05-30T06:07:03.886000+00:00",
  "created_at": "2026-06-01T09:51:03.104000+00:00",
  "modified_at": "2026-06-02T07:30:04+00:00",
  "created_at_opencti": "2026-06-01T09:51:03.104000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "bulletproof hosting",
    "clickfix",
    "drive-by attacks",
    "drivesurge",
    "fakeupdates",
    "initial access broker",
    "macos targeting",
    "ztds",
    "browser impersonation"
  ],
  "tags": [
    "2026-05-30",
    "2026-06-01",
    "browser impersonation",
    "bulletproof hosting",
    "clickfix",
    "drive-by attacks",
    "drivesurge",
    "fakeupdates",
    "initial access broker",
    "macos targeting",
    "ztds"
  ],
  "related_entities": {
    "indicators": [
      {
        "id": "e7a7f3a7-5e5b-4626-85ce-0478b9fd5cbf",
        "name": "46.226.166.57"
      },
      {
        "id": "4a344ed4-2bd5-4127-a88b-be3c938546de",
        "name": "http://newtdsone.shop/jsrepo?rnd="
      },
      {
        "id": "203aed7f-ff7b-42bc-bb35-d184a87bc8b1",
        "name": "check.first-node.rocks"
      },
      {
        "id": "8e529dab-40d5-4bed-ae21-f062833ecf91",
        "name": "29ac78c51bcdfe68c64830bdeb6e41437dd55e2691149741c9b78be03b6c82ea"
      },
      {
        "id": "12b5fdd2-c511-4d1a-92b5-7f13af98897d",
        "name": "webgleam.info"
      },
      {
        "id": "0019541b-cd1a-4bae-81be-1b9d44245a97",
        "name": "jclforwarding.com"
      },
      {
        "id": "45bde5aa-faf2-4f2f-bcc1-3e53f8e552ae",
        "name": "147.45.42.200"
      },
      {
        "id": "2369a582-99ae-4578-91e8-6a1e71e358e4",
        "name": "testio.ecartdev.com"
      },
      {
        "id": "a0e50737-48d2-4104-b819-81cd064c86c4",
        "name": "traceglimpse.icu"
      },
      {
        "id": "bcf66ccc-189a-4b6f-988e-f276ab39f2b8",
        "name": "tracekey.icu"
      },
      {
        "id": "29a1ba2f-5f3b-439a-b904-ad9f650b2655",
        "name": "brightson.icu"
      },
      {
        "id": "a4af9c30-c01f-4168-9110-abc9a736f255",
        "name": "datumprobe.icu"
      },
      {
        "id": "7db9d0bf-fab3-433b-bb49-7524f037a6c4",
        "name": "coverlink.icu"
      },
      {
        "id": "e9c69d4f-372d-490e-b556-910b99a1b284",
        "name": "91.92.240.127"
      },
      {
        "id": "756482f7-2e3e-4bfc-a7e9-b878e6bc2f5c",
        "name": "jcdlforwarding.com"
      },
      {
        "id": "fa9cadf9-cef3-491f-8cf1-33b14a1d0250",
        "name": "eraggifts.icu"
      },
      {
        "id": "c7f42ec8-5df8-4060-8fb1-6f1b365877cc",
        "name": "keyview.icu"
      },
      {
        "id": "c68936a1-ac4f-404d-8847-0d1bda3f27c6",
        "name": "cptoptious.com"
      },
      {
        "id": "5b9377b5-1fc4-4f47-abd2-af9dde894bfa",
        "name": "maxintora.com"
      },
      {
        "id": "af2cbc1a-ad53-4c0f-b40a-35be168d73a1",
        "name": "0c62c11e910d7c0d6b6c9800b70e78bfd9220e1f78bd7bb34ae4c3646d05f6e5"
      },
      {
        "id": "5313ffdd-264b-4138-a39a-368de8d9ef11",
        "name": "a84b032b49773c2318b11b1164d1aada69e940229aedbf8185c33fc7dd1d2cdf"
      },
      {
        "id": "7a18c852-21cb-467a-96a5-ad2ab86b7615",
        "name": "newtdsone.shop"
      },
      {
        "id": "9bd79627-bdab-4a7f-ab15-840b3679e92c",
        "name": "beacontrace.bond"
      },
      {
        "id": "6c3ab38b-4166-4425-bd2f-c6395dbd73a3",
        "name": "captioto.com"
      },
      {
        "id": "5007e341-7828-4d34-8560-6f5e6b17f8f6",
        "name": "90aecb370dfb1a99a1f7de0a9c6842ab1b664521fddea16b0ec9a91f322646fc"
      },
      {
        "id": "6f53ac04-7698-400d-ab35-7c0c76b7d51c",
        "name": "ztds.info"
      },
      {
        "id": "0d934c54-688d-4443-9c49-f279f5a97c99",
        "name": "http://bseolized.com"
      },
      {
        "id": "045db9de-7398-4321-a53f-66e9bd45e607",
        "name": "147.45.42.205"
      },
      {
        "id": "3c2e3cbf-e5a3-474f-b30d-97de3d0cef47",
        "name": "bseolized.com"
      },
      {
        "id": "dce4a22e-5930-4cb9-9e4f-a00a4e58f340",
        "name": "428bd0b0ac36dfdd223b3953dbe61c0baf227f893310b03e7afe3111462019c6"
      },
      {
        "id": "bf700bb6-5faa-4657-af28-181378a46c92",
        "name": "7aa15de93cf85729ddf970e8d7897f69ece3ca29608f73e784a9ba40c9cea18d"
      },
      {
        "id": "064a18f7-a13d-4681-96e5-559d7bb23d0c",
        "name": "ycyfugihih.cfd"
      }
    ],
    "intrusion_sets": [
      {
        "id": "8480c56f-a2e4-4b12-8c72-af0113b9522b",
        "name": "DriveSurge",
        "slug": "drivesurge"
      }
    ],
    "attack_patterns": [
      {
        "id": "16e4fc82-7c0b-4d1a-b784-b804b4df26dc",
        "name": "T1204.001"
      },
      {
        "id": "79525d9e-3824-4347-a471-7dcea20fd864",
        "name": "T1583.006"
      },
      {
        "id": "eaff4611-3c78-4127-8745-726f77ed68ba",
        "name": "T1070.004"
      },
      {
        "id": "5882a135-5b7e-4caf-93e8-80f7df41cef2",
        "name": "T1564.001"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "7671fe3e-6a85-463e-928d-16117d2f4f9b",
        "name": "T1059.006"
      },
      {
        "id": "4716a930-cb46-4d50-803a-9e1aaa6be5e9",
        "name": "T1588.004"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "886bf3fa-4e64-498b-9cba-f64619cfd501",
        "name": "T1090.002"
      },
      {
        "id": "2e0c6db7-16a7-4bf6-992e-263474014fce",
        "name": "T1059.004"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "fe6f2946-a01e-460c-9636-8c48b45dd0e6",
        "name": "T1189"
      },
      {
        "id": "d19f56ca-5ce8-4bd1-af90-7d83e394470c",
        "name": "T1583.001"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "e46a9411-d2a1-47c9-8820-c7f818f4c0b5",
        "name": "T1203"
      }
    ],
    "observables": [
      {
        "id": "825ba1da-5fc4-4ee9-9bc9-2669ae6026da",
        "name": "jcdlforwarding.com"
      },
      {
        "id": "ce4d96db-28d0-48b5-86d1-5dc83e3c0b86",
        "name": "ycyfugihih.cfd"
      },
      {
        "id": "23c246d2-78fa-47f8-9c58-285a412f09e7",
        "name": "eraggifts.icu"
      },
      {
        "id": "c588d404-26da-4724-b9a1-5f22d01a3e94",
        "name": "cptoptious.com"
      },
      {
        "id": "c6184d8e-d842-465e-9a3d-816128668a8f",
        "name": "beacontrace.bond"
      },
      {
        "id": "84f639e6-7a0d-4354-ae8c-d1615aed9c9e",
        "name": "captioto.com"
      },
      {
        "id": "269d42bb-df50-4547-9415-ab4c1fb92684",
        "name": "datumprobe.icu"
      },
      {
        "id": "e6ff4a7c-8f20-4abe-8b5c-46b48def8568",
        "name": "brightson.icu"
      },
      {
        "id": "956e4e44-defd-4850-8b16-6d9f8680793f",
        "name": "maxintora.com"
      },
      {
        "id": "35950c81-aeec-4d62-8c82-a1cf16bc4550",
        "name": "ztds.info"
      },
      {
        "id": "9d772106-8186-4bfd-bdd2-c68ca4718af8",
        "name": "webgleam.info"
      },
      {
        "id": "78ce136f-1ad9-4fd5-acd7-a45f97e6a0d5",
        "name": "traceglimpse.icu"
      },
      {
        "id": "86e251c0-1038-4674-8640-ee20124c1a34",
        "name": "tracekey.icu"
      },
      {
        "id": "94576b77-97dd-4b01-b2e6-d2441b1e88d4",
        "name": "coverlink.icu"
      },
      {
        "id": "ff400133-603c-4afc-937c-378453ac9fd3",
        "name": "bseolized.com"
      },
      {
        "id": "bdf636b9-4bd2-4e2a-ab2f-198ba6bcf40d",
        "name": "jclforwarding.com"
      },
      {
        "id": "f6065d6f-bf3c-41aa-95eb-5f34f13f9bd4",
        "name": "newtdsone.shop"
      },
      {
        "id": "acd43952-6e97-48d5-9d91-323b54e894be",
        "name": "keyview.icu"
      },
      {
        "id": "2d032e33-a69e-44b6-99d0-62f22d40fcaa",
        "name": "testio.ecartdev.com"
      },
      {
        "id": "e4273efe-db81-4684-b1cf-38ace5140760",
        "name": "check.first-node.rocks"
      },
      {
        "id": "9b29ed7e-410a-4bf9-b1b0-fd92ac5f9314",
        "name": "147.45.42.200"
      },
      {
        "id": "93fb4443-0db3-4ae4-b7e7-9e3a5d6c04e6",
        "name": "147.45.42.205"
      },
      {
        "id": "50b29090-bd56-4a98-9746-255838cbcb4e",
        "name": "91.92.240.127"
      },
      {
        "id": "cf0799b8-51c0-4c9d-95da-218b136fbc9e",
        "name": "46.226.166.57"
      },
      {
        "id": "2a79cd57-942f-4409-830a-2d9bd58c1ee0",
        "name": "http://newtdsone.shop/jsrepo?rnd="
      },
      {
        "id": "c3960995-c34c-4136-b228-ee84c0122508",
        "name": "http://bseolized.com"
      },
      {
        "id": "",
        "name": "29ac78c51bcdfe68c64830bdeb6e41437dd55e2691149741c9b78be03b6c82ea"
      },
      {
        "id": "",
        "name": "0c62c11e910d7c0d6b6c9800b70e78bfd9220e1f78bd7bb34ae4c3646d05f6e5"
      },
      {
        "id": "",
        "name": "a84b032b49773c2318b11b1164d1aada69e940229aedbf8185c33fc7dd1d2cdf"
      },
      {
        "id": "",
        "name": "90aecb370dfb1a99a1f7de0a9c6842ab1b664521fddea16b0ec9a91f322646fc"
      },
      {
        "id": "",
        "name": "428bd0b0ac36dfdd223b3953dbe61c0baf227f893310b03e7afe3111462019c6"
      },
      {
        "id": "",
        "name": "7aa15de93cf85729ddf970e8d7897f69ece3ca29608f73e784a9ba40c9cea18d"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "check.first-node.rocks"
      },
      {
        "id": "",
        "name": "webgleam.info"
      },
      {
        "id": "",
        "name": "jclforwarding.com"
      },
      {
        "id": "",
        "name": "testio.ecartdev.com"
      },
      {
        "id": "",
        "name": "traceglimpse.icu"
      },
      {
        "id": "",
        "name": "tracekey.icu"
      },
      {
        "id": "",
        "name": "brightson.icu"
      },
      {
        "id": "",
        "name": "datumprobe.icu"
      },
      {
        "id": "",
        "name": "coverlink.icu"
      },
      {
        "id": "",
        "name": "jcdlforwarding.com"
      },
      {
        "id": "",
        "name": "eraggifts.icu"
      },
      {
        "id": "",
        "name": "keyview.icu"
      },
      {
        "id": "",
        "name": "cptoptious.com"
      },
      {
        "id": "",
        "name": "maxintora.com"
      },
      {
        "id": "",
        "name": "newtdsone.shop"
      },
      {
        "id": "",
        "name": "beacontrace.bond"
      },
      {
        "id": "",
        "name": "captioto.com"
      },
      {
        "id": "",
        "name": "ztds.info"
      },
      {
        "id": "",
        "name": "bseolized.com"
      },
      {
        "id": "",
        "name": "ycyfugihih.cfd"
      }
    ]
  },
  "external_refs": [
    {
      "id": "0438ae2f-79ef-4527-be8d-7a1d88f9ac82",
      "standard_id": "external-reference--4b18f813-3246-5f31-bd97-c7aaa2f2da1b",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.silentpush.com/blog/drivesurge/",
      "hash": null,
      "external_id": null,
      "created": "2026-06-01T09:51:03.018Z",
      "modified": "2026-06-01T09:51:03.018Z",
      "createdById": null
    },
    {
      "id": "79527d32-dde6-4bce-b456-0b2df7347150",
      "standard_id": "external-reference--7c3664e3-8673-546a-843d-b28e0aaf1095",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a1a7e87f6f70533d1443f96",
      "hash": null,
      "external_id": "6a1a7e87f6f70533d1443f96",
      "created": "2026-06-01T09:51:02.989Z",
      "modified": "2026-06-01T09:51:02.989Z",
      "createdById": null
    },
    "https://otx.alienvault.com/pulse/6a1dde5fb26dd1b1cbbdb913",
    "https://www.silentpush.com/blog/drivesurge/?utm_source=rss&utm_medium=rss&utm_campaign=drivesurge"
  ]
}