# DriveSurge: Fake Update Attacks on Thousands of Trusted Sites New threat actor DriveSurge redirects visitors to malicious software. - **Source:** [CyberWire Daily](https://brifing.si/source/08fbf94c-e51b-42cb-be13-84db10e5d993) - **Published:** 2026-07-18 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/a0d4ac4b-8f4c-463f-8628-0866f7500af2 ## DriveSurge Threat Unveiled Silent Push researchers have identified a new threat actor named DriveSurge, which has compromised thousands of legitimate websites. The group lures visitors with fake browser updates to redirect them to malware downloads. The attacks specifically target Windows and macOS users. ## ClickFix and Fake Update Lures DriveSurge uses a method called ClickFix to redirect users to fake update pages. These pages trick users into downloading malware. The attacks are carried out on a large scale using a pay-per-install model. ## Traffic Redirection via zTDS The group uses a traffic distribution system called zTDS to silently redirect visitors to malicious content. This system employs advanced infrastructure and fingerprinting techniques to evade detection. The scale and complexity of the attacks are notable. ## Windows and macOS Users Targeted DriveSurge targets both Windows and macOS users, reaching a broad audience. Researchers note that similar tactics are used for both operating systems, highlighting the multifaceted nature of the threat. ## Defense Measures and Fingerprints Silent Push has shared eight infrastructure fingerprints to help identify DriveSurge's operations. This information can aid defense teams in preventing attacks. The research is critical for cybersecurity professionals. ## Cybersecurity Awareness The DriveSurge case shows that even trusted sites can become threats. Users must remain vigilant against fake update alerts and keep their security measures up to date. The research sheds light on the evolution of cyber threats. ## Sources covering this story - https://thecyberwire.com/podcasts/research-saturday/433/notes — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._