Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks

Multiple active campaigns and exploited vulnerabilities were reported: a threat actor called DriveSurge is hijacking thousands of sites to deliver ClickFix and FakeUpdate malware; over 30 Red Hat npm packages were backdoored to deliver a new Shai‑Hulud credential stealer variant dubbed “Miasma”; WordPress sites (including via WP Maps Pro) and ~2,000 sites were abused to hide malware/C2 (Steam profile comments); ChatGPT share links were abused to host fake outage pages delivering malware; and a critical Windows Netlogon RCE is being exploited in the wild. Security incidents, outages, and auth/M