A large-scale malicious campaign called DriveSurge has been documented by Dark Reading researchers, revealing the compromise of thousands of legitimate websites to distribute ClickFix and FakeUpdate malware through social engineering attacks targeting everyday internet users. The campaign represents the continuing sophistication of drive-by compromise operations that exploit the trust users place in websites they visit regularly.

ClickFix attacks present users with fake error messages claiming that their browser needs to execute a command to fix a displayed problem. The messages include a "fix" that involves opening a terminal or run dialog and pasting attacker-provided code. Remarkably, this technique continues to succeed despite its inherent visibility: users are literally being asked to execute malicious code themselves. The success of ClickFix speaks to both the effectiveness of social engineering and the general population's lack of security awareness.

FakeUpdate attacks, perfected by groups like the SocGholish organization disrupted earlier this year, present realistic-looking browser update notifications to website visitors. When visitors click to update, they download malware. The compromised legitimate websites that host these attacks provide a form of camouflage: security tools that block connections to known malicious domains often cannot effectively block content served from legitimate websites that have been secretly modified.

DriveSurge's scale — thousands of compromised sites — reflects the effectiveness of automated website compromise at scale. The attackers reportedly identified target sites through automated vulnerability scanning, focusing on WordPress installations with outdated plugins or weak administrative credentials. Once access was obtained, automated tools deployed the attack code across all compromised sites simultaneously, creating a distribution network of thousands of malicious pages served from apparently legitimate domains.

Webmasters and organizations hosting websites should treat this incident as a call to action on website security fundamentals. Maintaining up-to-date WordPress core and plugin versions, implementing Web Application Firewalls, using strong and unique administrative credentials, and monitoring websites for unauthorized content changes are basic hygiene measures that would have prevented most of the DriveSurge compromises. Website integrity monitoring — tools that detect unexpected changes to website files — should be considered a standard component of any web presence security program.