Thousands of Sites Hijacked for Cyberattacks

A significant ClickFix campaign known as DriveSurge is currently infecting numerous computers with backdoor malware, with attackers selling the compromised access on the dark web. This campaign leverages thousands of legitimate, high-reputation websites by injecting malicious scripts that redirect visitors to malware. Visitors are profiled, and depending on the assessment, they are served either ClickFix or FakeUpdates. Both methods aim to install backdoor malware, granting attackers unrestricted access to the victim's system. This access is subsequently sold to other criminal groups for various illicit purposes, including data theft and ransomware attacks.