According to Europol, another tool that disrupted Operation Endgame was SocGholish. It is a malware installer tied to the Russian cybercrime group Evil Corp. that distributes via hacked websites.
Malware family Windows
SocGholish
SocGholish, also widely known as FakeUpdates and sometimes referred to as GhoLoader, is a malware distribution framework and loader used to obtain initial access to victim systems.
Profile source: Mallory opens in a new tabSocGholish
Family profile
SocGholish, also widely known as FakeUpdates and sometimes referred to as GhoLoader, is a malware distribution framework and loader used to obtain initial access to victim systems. It is best known for compromising legitimate websites—especially WordPress sites—and presenting visitors with fake browser or software update prompts that trick users into executing malicious payloads. The malware has been consistently associated with large-scale traffic distribution infrastructure and has been described as one of the most prevalent initial access mechanisms in the contemporary cybercrime ecosystem.
SocGholish functions primarily as a loader or dropper rather than as a standalone end-stage payload. After execution, it enables follow-on compromise by delivering additional malware and facilitating unauthorized access that can be monetized by other actors. Access obtained through SocGholish infections has been linked to downstream cybercrime including ransomware deployment, data theft, and broader post-compromise operations. Reporting has repeatedly linked the operation to the Russian cybercrime group Evil Corp, and the access it provides has been noted as valuable to financially motivated intrusion actors.
Operationally, SocGholish relies on compromised legitimate websites as its core delivery channel. Threat actors inject malicious content into websites so that visitors are redirected or shown fraudulent update lures. This fake-update model allows the operators to blend malicious delivery into normal web browsing behavior while exploiting user trust in familiar software update workflows. The ecosystem around SocGholish has also been tied to traffic delivery systems used to route and filter victims and to support evasion and large-scale distribution.
The malware has been the subject of major international disruption efforts under Operation Endgame. Those actions targeted infrastructure used to distribute SocGholish, remediated large numbers of compromised websites, and highlighted its role in the broader cybercrime supply chain. SocGholish remains significant because it bridges web compromise and user deception with initial access brokerage, enabling other criminal operators to conduct ransomware, credential abuse, and additional malicious activity at scale.
Capabilities
- Defense Evasion
- Initial Access
- Post Exploitation
Reported operators
Threat actors
15 named in public reportingRecorded Future exploits TDS to demonstrate a high-level activity strategy that includes regularly updating URLs embedded in WordPress sites, adding additional servers, and improving TDS logic to evade detection, and has been linked to SocGholish and D3F@ck Loader malware, as well as the Rhysida and Interlock ransomware groups.
Active since 2017 and also known as FakeUpdates, SocGholish is a JavaScript (JS)-based downloader malware that typically serves as a conduit for next-stage malware from various threat actors like Evil Corp, LockBit, RansomHub, Dridex, and Raspberry Robin.
Active since 2017 and also known as FakeUpdates, SocGholish is a JavaScript (JS)-based downloader malware that typically serves as a conduit for next-stage malware from various threat actors like Evil Corp, LockBit, RansomHub, Dridex, and Raspberry Robin.
The threat actors SocGholish ... compromise legitimate WordPress sites and use Traffic Direction/Distribution Systems (TDS) to redirect visitors to webinjects hosted there ... and trick end users into drive by downloading of malware.
TAG-124 has also been associated with SocGholish and D3F@ck loader malware, which provide remote access and malware delivery for financially motivated activity.
A coordinated SocGholish (FakeUpdates) campaign wave launched 2026-03-02 deployed 11 stage-1 JavaScript injectors across 6 distinct C2 domains hosted by 4 providers spanning Panama, the United States, and Canada.
A coordinated SocGholish (FakeUpdates) campaign wave launched 2026-03-02 deployed 11 stage-1 JavaScript injectors across 6 distinct C2 domains hosted by 4 providers spanning Panama, the United States, and Canada.
"SocGholish, also called FakeUpdates, is a JavaScript loader malware that's distributed via compromised websites by masquerading as deceptive updates for web browsers like Google Chrome or Mozilla Firefox..."
SocGholish, operated by TA569, actually functions as a Malware-as-a-Service (MaaS) vendor, selling access to compromised systems to various financially motivated cybercriminal clients. The primary tactic used involves deceptive “fake browser update” lures...
SocGholish, operated by TA569, actually functions as a Malware-as-a-Service (MaaS) vendor, selling access to compromised systems to various financially motivated cybercriminal clients. The primary tactic used involves deceptive “fake browser update” lures...
SocGholish, operated by TA569, actually functions as a Malware-as-a-Service (MaaS) vendor, selling access to compromised systems to various financially motivated cybercriminal clients. The primary tactic used involves deceptive “fake browser update” lures...
"Throughout 2024 we continued to observe a low volume of SocGholish infections... upon execution the JavaScript payload connects back to SocGholish infrastructure... and can retrieve additional malware."
“VexTrio Viper runs the largest and oldest known TDS with over 165 affiliates including SocGholish and ClearFake.”
Arctic Wolf Labs assesses with a medium-to-high confidence level that Russia’s GRU unit 29155 is utilizing SocGholish to target victims. .. Actor: TA569 is considered the primary threat actor deploying and maintaining SocGholish... The operator serves as an Initial Access Broker (IAB), selling access to compromised systems to ransomware affiliates.
Exploited software
Vulnerabilities linked to SocGholish
1 CVEsMITRE ATT&CK
SocGholish in ATT&CK
58 distinct techniquesTechniques
58 techniques T1189 Drive-by Compromise T1082 System Information Discovery T1078 Valid Accounts T1204.002 Malicious File T1204 User Execution T1566.002 Spearphishing Link T1587.001 Malware T1105 Ingress Tool Transfer T1584.006 Web Services T1566 Phishing T1071 Application Layer Protocol T1036 Masquerading T1584 Compromise Infrastructure T1110.003 Password Spraying T1059.007 JavaScript T1059.001 PowerShell T1219 Remote Access Tools T1190 Exploit Public-Facing Application T1583.001 Domains T1205 Traffic Signaling T1497.001 System Checks T1584.001 Domains T1505.003 Web Shell T1136 Create Account T1027 Obfuscated Files or Information T1059 Command and Scripting Interpreter T1497 Virtualization/Sandbox Evasion T1056 Input Capture T1033 System Owner/User Discovery T1016 System Network Configuration Discovery T1046 Network Service Discovery T1547.001 Registry Run Keys / Startup Folder T1074 Data Staged T1057 Process Discovery T1590 Gather Victim Network Information T1047 Windows Management Instrumentation T1056.001 Keylogging T1556 Modify Authentication Process T1608.001 Upload Malware T1071.001 Web Protocols T1059.005 Visual Basic T1555.003 Credentials from Web Browsers T1486 Data Encrypted for Impact T1187 Forced Authentication T1518 Software Discovery T1087 Account Discovery T1614.001 System Language Discovery T1041 Exfiltration Over C2 Channel T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol T1204.001 Malicious Link T1482 Domain Trust Discovery T1027.013 Encrypted/Encoded File T1074.001 Local Data Staging T1036.005 Match Legitimate Resource Name or Location T1027.015 Compression T1102 Web Service T1614 System Location Discovery T1583.006 Web Services
Reporting
Research mentioning SocGholish
Jul 12
Cysecurity News
Operation Endgame Disrupts Global Cyber Crime Assembly Line - CySecurity News - Latest Information Security and Hacking Incidents
According to Europol, another tool that disrupted Operation Endgame was SocGholish. It is a malware installer tied to the Russian cybercrime group Evil Corp. that distributes via hacked websites.
Jul 10
Trojan Killer News
WP-SHELLSTORM Webshells Hit WordPress Sites
Trojan Killer recently covered a similar cleanup lesson in the SocGholish WordPress takedown, where the safest response was not only to remove the visible injection but also to rotate credentials and check the admin machines used to manage the site.
Jul 7
Gurucul Threat Research
Millenium: A RAT Rewritten, a Threat Multiplied | Community Portal | Gurucul
SocGholish1
Jun 30
Belgium Ccb Product Advisories
Warning: WordPress sites targeted by botnet to distribute malware | CCB Belgium
This campaign has been heavily driven by the "SocGholish" botnet, which utilizes compromised or stolen credentials to gain administrative access to WordPress environments.
Jun 29
Xakep
Правоохранительные органы нарушили работу инфраструктуры малвари Amadey и StealC - Хакер
Ранее в этом месяце, в ходе этой же фазы операции Endgame, правоохранительные органы вывели из строя инфраструктуру загрузчика SocGholish (он же FakeUpdates и GhoLoader).
Jun 26
Zdnet
Comment l’IA a permis de mettre en lumière les liens entre Amadey ...
L’agence européenne de police a en effet annoncé le démantèlement d’une infrastructure criminelle plus large comprenant également les dropper Amadey et SocGholish.
Jun 25
Techrepublic Com Security
Europol, Microsoft Hit Malware Network Behind 27M Stolen Logins, 140,000 Infected Computers
SocGholish/FakeUpdates: Spread through fake browser or software updates on compromised websites.
Jun 25
Scworld
StealC infrastructure takedown assisted by AI analysis, C2 infiltration | news | SC Media
Europol announced it seized more than €41 million (about $47 million USD) in crypto assets and identified about 27 million stolen credentials in total throughout its investigations of StealC, Amadey and SocGholish, the latter of which subject to takedowns last week.
