Meet DriveSurge: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites

Based on the detailed report provided, here's a summary and key findings regarding the DriveSurge campaign targeting compromised websites to serve fake browser updates:

Summary of Findings

DriveSurge Campaign Overview

• Date Range: April - May 2026
• Primary Tactic: Compromising legitimate websites to serve malicious payloads disguised as browser update pages.
• Targeted Browsers: Mozilla Firefox and potentially other browsers (11 in total).
• Malware Distribution: ZIP file containing DLLs and an executable ("Browser Update.exe") masquerading as a legitimate browser update.

Key Infrastructures Identified

1. DriveSurge Registration Email: [email protected]
   • Registered domains using this email over two weeks.
2. Temporary Email Service Provider: tempmail.so (used for long-term mailbox accounts).

Compromised Websites

• Example: jclforwarding.com
  • Served fake Mozilla Firefox update page through check.first-node.rocks.
  • Downloaded ZIP file with malicious DLLs and executable.

Detailed Analysis

Fingerprints Developed

Read the full article at Malware Analysis, News and Indicators - Latest topics

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.