A threat actor called DriveSurge has compromised thousands of legitimate, high-reputation websites and is using them to redirect visitors toward malware delivery pages. Any employee browsing the web from a corporate device is a potential victim, regardless of whether the site they visit appears trustworthy. Because DriveSurge sells access to infected machines to other criminal groups, the downstream malware is unpredictable and may include ransomware, data stealers, or remote access tools.