Tag: fakeupdates

3 Attack Reports | 0 Vulnerabilities

Attack reports

A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites

A sophisticated threat actor named DriveSurge operates as an Initial Access Broker using a Pay-Per-Install model to deliver malware at scale. The actor compromises thousands of legitimate websites and uses zTDS (Traffic Distribution System) to silently redirect visitors to malicious content. Victim…

initial access broker

bulletproof hosting

drive-by attacks

macos targeting

browser impersonation

Published: June 1, 2026

Downloadable IOCs: 11

Don't Ghost the SocGholish: GhostWeaver Backdoor

The article details a sophisticated malware infection chain involving SocGholish, MintsLoader, and the GhostWeaver backdoor. The attack begins with a fake browser update, progressing through multiple stages to deploy a PowerShell backdoor and various plugins. These components work together to steal…

credential theft

juniper stealer

Published: February 17, 2025

Downloadable IOCs: 14

Fake Browser Updates Lead to BOINC Volunteer Computing Software

This report details a recent malware campaign involving the infamous SocGholish/FakeUpdates malware, which tricks users into downloading fake browser updates. However, instead of installing common remote access tools (RATs) as the final payload, some infections resulted in the installation of the l…

Published: July 22, 2024

Downloadable IOCs: 17

Click here to see more Attack Reports