About this episode

Lauren Fievisohn discusses the newly identified threat actor DriveSurge and their methods of distributing malware through compromised websites.

Lauren Fievisohn, Ph.D, Senior Threat Researcher from Silent Push, is sharing their work on "Meet DriveSurge: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites." Silent Push researchers have identified a newly named threat actor, DriveSurge, which has compromised thousands of legitimate websites and uses ClickFix and fake browser update lures to distribute malware at scale through a pay-per-install operation. The group leverages a traffic distribution system called zTDS to silently redirect visitors from trusted websites to malicious payloads, while employing sophisticated infrastructure, obfuscation, and fingerprinting techniques to evade detection. The report also details how DriveSurge targets both Windows and macOS users and provides defenders with eight infrastructure fingerprints to help identify and disrupt the campaign. The research and executive brief can be found here: Meet DriveSurge: A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites Learn more about your ad choices. Visit megaphone.fm/adchoices

People in this episode

Guest: Lauren Fievisohn, Ph.D

Topics covered

• cybersecurity
• malware
• threat actors
• website compromise
• traffic distribution
• obfuscation techniques

Keywords

• DriveSurge
• malware
• ClickFix
• fake updates
• website compromise
• cyber threats
• traffic distribution
• obfuscation
• Windows
• macOS

Mentioned in this episode

Organizations: Silent Push, DriveSurge, ClickFix, zTDS, Windows, macOS

More episodes of CyberWire Daily

• Behind the friendly face. · July 20, 2026 · 29 min
• Europe's push for space sovereignty. [T-Minus: Space-Cyber Briefing] · July 19, 2026 · 31 min
• A nightmare on Windows street. · July 17, 2026 · 26 min
• For hackers, sharing is caring. · July 16, 2026 · 30 min
• Patchapalooza packs a punch. · July 15, 2026 · 28 min
• The ransomware toll road. · July 14, 2026 · 26 min

Explore listener stats, chart rankings, contacts and more on the CyberWire Daily podcast page.