DriveSurge Hijacks Thousands of Sites for ClickFix, FakeUpdate Attacks

Researchers discovered DriveSurge, an industrialized initial-access-for-hire operation that hijacks thousands of legitimate websites using the open-source zTDS traffic distribution system to route victims to FakeUpdate and ClickFix payloads (targeting Windows and macOS). The campaign uses obfuscated JavaScript, platform profiling, payload repositories, fallback domains, and pay-per-install mechanisms to sell high-quality access; defenders are advised to block malicious domains, monitor for suspicious outbound traffic and injected JavaScript, and train users not to paste commands or install updates from non-vendor sources.