Researcher @Malwarehunterr says surgebuilders.ink impersonates Surge Group jobs and uses ClickFix commands to install info-stealing malware. Surge Group is not involved.
Source: x.com · published
On 8 November 2026 the security researcher @Malwarehunterr posted on X that surgebuilders[.]ink impersonates Surge Group and advertises remote software-engineering jobs. The post says the site uses ClickFix-style verification to trick applicants into executing CMD or PowerShell commands, and that a downloaded BAT file launches an encrypted Node.js payload called install_guard.js. Surge Group is impersonated and is not involved; this is not an official Surge Group hiring site.
According to the post, analysis of previously decrypted code found the malware can steal browser credentials and sensitive files, target SSH keys, cryptocurrency wallets and tokens, perform Windows DPAPI-related operations, persist on the system, run additional payloads and pull remote configuration from a GitLab repository at gitlab.com/up-indexings/tasks. Named infrastructure also included api.gamsterb[.]ink, api.fallgamsterb[.]ink, api.cerysoi[.]ink and buildwithknexus[.]xyz, the last of which was noted as unavailable. The researcher said the final-stage executable had not yet been recovered.
ClickFix verification works by showing an error or security check on a webpage and telling the visitor to copy a command into the Windows Run box, Command Prompt or PowerShell to continue. That command downloads and runs the BAT file, giving the malware access that a normal webpage would not have. Fake job sites are an effective lure because applicants already expect to follow unusual onboarding steps and may trust a familiar company name. The researcher's screenshot of the landing page shows a Senior Software Engineer remote role under Surge branding with an Apply button.
Apply only through a company's official careers site that you typed or navigated to yourself. Never paste commands from a job page into CMD, PowerShell or Run. Anyone who ran such a command should disconnect the computer, change passwords from a clean device, revoke SSH keys and wallet access, and have the machine scanned. The details come from the researcher's post and have not been independently checked by scammers.com.
Post by @Malwarehunterr on X, 8 November 2026, on surgebuilders.ink. Not independently verified by scammers.com.
MalwareTips published an investigation today rating hervalife.com a high-risk store that belongs to a scam network of near-identical shops sharing templates, product photos and return policies and reopening under new…
MalwareTips published an investigation today rating stampsusps.com a high-risk store that belongs to a scam network of near-identical shops sharing templates, product photos and return policies and reopening under new…
MalwareTips published an investigation today calling bertund.shop a fake store built on a copied catalog. It says the site's catalog listings, photos and branding are taken from real brands and stores, none of which o…
PhishDestroy posted on Mastodon on 12 November 2026 that xxvv435[.]weebly[.]com is a phishing page. Its record describes an Onet Poczta login page with email and password fields, flagged by 19 of 92 VirusTotal engines…
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that promogiftwinter[.]com is a phishing site. Its record shows a page titled "Steam, The Ultimate Online Game Platform" offering a Steam-branded $50 gift card with…