DriveSurge: Fake Update Attacks on Thousands of Trusted Sites
New threat actor DriveSurge redirects visitors to malicious software.
1DriveSurge Threat Unveiled
Silent Push researchers have identified a new threat actor named DriveSurge, which has compromised thousands of legitimate websites. The group lures visitors with fake browser updates to redirect them to malware downloads. The attacks specifically target Windows and macOS users.
2ClickFix and Fake Update Lures
DriveSurge uses a method called ClickFix to redirect users to fake update pages. These pages trick users into downloading malware. The attacks are carried out on a large scale using a pay-per-install model.
3Traffic Redirection via zTDS
The group uses a traffic distribution system called zTDS to silently redirect visitors to malicious content. This system employs advanced infrastructure and fingerprinting techniques to evade detection. The scale and complexity of the attacks are notable.
4Windows and macOS Users Targeted
DriveSurge targets both Windows and macOS users, reaching a broad audience. Researchers note that similar tactics are used for both operating systems, highlighting the multifaceted nature of the threat.
5Defense Measures and Fingerprints
Silent Push has shared eight infrastructure fingerprints to help identify DriveSurge's operations. This information can aid defense teams in preventing attacks. The research is critical for cybersecurity professionals.
6Cybersecurity Awareness
The DriveSurge case shows that even trusted sites can become threats. Users must remain vigilant against fake update alerts and keep their security measures up to date. The research sheds light on the evolution of cyber threats.