{"id":261545,"date":"2026-06-01T18:14:00","date_gmt":"2026-06-01T22:14:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/06\/01\/hackers-hijack-thousands-of-sites-for-clickfix-and-fakeupdate-attacks\/"},"modified":"2026-06-01T20:45:11","modified_gmt":"2026-06-02T00:45:11","slug":"hackers-hijack-thousands-of-sites-for-clickfix-and-fakeupdate-attacks","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/06\/01\/hackers-hijack-thousands-of-sites-for-clickfix-and-fakeupdate-attacks\/","title":{"rendered":"Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks"},"content":{"rendered":"

Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks<\/a><\/p>\n

https:\/\/www.bleepingcomputer.com\/news\/security\/hackers-hijack-thousands-of-sites-for-clickfix-and-fakeupdate-attacks\/<\/a><\/p>\n

Publish Date: 2026-06-01 18:14:00<\/a><\/p>\n

Source Domain: www.bleepingcomputer.com<\/a><\/p>\n

\n

A threat actor tracked as DriveSurge has been operating large-scale malware distribution campaigns using ClickFix and FakeUpdates techniques on compromised sites.<\/p>\n

Thousands of websites have been compromised in DriveSurge campaigns to redirect visitors to malware-delivery infrastructure, according to researchers at cybersecurity company SilentPush.<\/p>\n

ClickFix is a popular social engineering tactic that deceives victims into copying and executing malicious commands on their systems, often resulting in malware infections under the pretense of resolving a technical issue.<\/p>\n

\"image\"<\/p>\n

In FakeUpdates attacks, threat actors entice victims with fraudulent software update prompts, usually impersonating browser updates, to trick them into downloading and installing malicious payloads.<\/p>\n

According to Silent Push researchers, the DriveSurge threat actor primarily functions as an initial access broker (IAB) operating on a pay-per-install (PPI) model, enabling follow-on attacks.<\/p>\n

Visitors of compromised websites are redirected through a Traffic Distribution System (TDS) known as zTDS, which profiles them and determines whether a FakeUpdates or a ClickFix lure is more appropriate.<\/p>\n

\"ClickFixClickFix example from the campaign<\/strong>
Source: Silent Push<\/p>\n

zTDS is an open-source TDS that has existed since at least 2015 and that DriveSurge has been using since at least September 2025.<\/p>\n

\u201cUsing zTDS, DriveSurge hijacks thousands of legitimate, high-reputation websites and silently redirects visitors to malware, unbeknownst to the sites\u2019 owners or their visitors,\u201d Silent Push says.<\/p>\n

The FakeUpdates lures contain bogus update notices for Chrome, Firefox, Edge, Safari, Opera, Brave, Yandex, Vivaldi, Samsung Internet, and UC Browser, while the ClickFix attacks involve PowerShell commands.<\/p>\n

A case highlighted in the Silent Push report involves a fake Firefox update that downloaded a ZIP archive containing multiple DLLs and a malicious executable named \u2018Browser Update.exe.\u2019<\/p>\n

\"AA fake…<\/strong>
\n
Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks https:\/\/www.bleepingcomputer.com\/news\/security\/hackers-hijack-thousands-of-sites-for-clickfix-and-fakeupdate-attacks\/ Publish Date: 2026-06-01 18:14:00…<\/p>\n","protected":false},"author":1,"featured_media":261546,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.bleepstatic.com\/content\/hl-images\/2026\/05\/19\/box.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[24,32,34],"class_list":["post-261545","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity","tag-malware","tag-threat-actor"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/261545"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=261545"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/261545\/revisions"}],"predecessor-version":[{"id":261547,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/261545\/revisions\/261547"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/261546"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=261545"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=261545"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=261545"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}