NewsPublished 1 Jun 2026

Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks

Source Bleeping Computer

Description

A threat actor tracked as DriveSurge has been operating large-scale malware distribution campaigns using ClickFix and FakeUpdates techniques on compromised sites. [...]

Impact

The campaign results in malware infections on victim systems through social engineering, potentially leading to further compromise facilitated by DriveSurge's pay-per-install model. Legitimate websites are hijacked without owners' knowledge, exposing their visitors to malicious redirects and payloads. The threat affects multiple browsers and operating systems, increasing its reach. There is no indication of direct exploitation of software vulnerabilities; the attack relies on deception and compromised infrastructure.

Defensive guidance

Users should only download browser updates through the official application settings menu (About > Check for Updates) and avoid executing commands in command prompts or terminals unless fully understood. Website owners should investigate and remediate unauthorized JavaScript injections, specifically those matching the 't.js?site=<id>' pattern, and monitor for signs of compromise. Since this is a malware distribution campaign leveraging compromised sites, remediation involves cleaning affected websites and improving security to prevent reinfection.

References

bleepingcomputer.com/news/security/hackers-hijack-thousands-of-sites-for-clickfix-and-fakeupdate-attacks/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 1 Jun 2026, 22:18 UTC

References

Community reviews