1,509 WordPress sites feed an active SocGholish chain

The first malware server in this campaign is the site the victim meant to visit.

Between April 21 and July 21, 2026, we observed one integrated operation across 1,509 WordPress hosts. The compromised site issues an opaque token, walks the browser through a three-request eligibility check, and executes the controller's reply under its own trusted hostname.

Selected Windows visitors receive a SocGholish fake update. The lure downloads Google Launcher.js, and GhoLoader asks its controller what to run next.

Proofpoint's June 2026 analysis (opens in new tab) assigns TA2726 to the gateway and TA569/SocGholish to fake-update delivery. We retain those labels to map our artifacts onto its prior work. The observed chain is one operation.

Two domains recovered from a successful gateway response carry direct SocGholish tags in ThreatFox. A third campaign pivot is classified as FAKEUPDATES, whose aliases include SocGholish and GhoLoader.

Some of the same WordPress hosts later acquired a ClickFix injection backed by Polygon EtherHiding. We refer to the earlier SocGholish gateway as a ClickFix precursor.

---

Campaign snapshot

Every match for the exact s6qgn route in that window belonged to the malicious framework.

---

One chain from WordPress to GhoLoader

The working path is:

compromised WordPress page
  -> injected fake-plugin JavaScript
  -> /wp-admin/admin-ajax.php token bootstrap
  -> same-origin gateway
  -> controller-supplied visitor checks
  -> controller decision
       -> stop or error
       -> external loader
            -> SocGholish fake browser update
            -> Google Launcher.js
            -> GhoLoader
            -> controller-supplied code

The first requests stay on the legitimate hostname. WordPress relays browser state to an upstream controller and returns executable JavaScript. Network logs record traffic to the site the victim chose. The compromised server handles the criminal forwarding.

The labels locate activity inside the chain. The s6qgn route marks the gateway phase. The returned loader and downstream domains tie the operation to SocGholish.

---

Three knocks on the same hostname

A representative injected configuration contains four values:

gateway:      https://<site>/wp-json/platformist-quadendpointer-sxadtr/v1/s6qgn
campaign ID:  T6cSdwTEXsJcDYRlaQf-Iw
AJAX URL:     https://<site>/wp-admin/admin-ajax.php
AJAX action:  multiapping_fastapiity

On page load, the script asks WordPress for its first state token:

POST /wp-admin/admin-ajax.php
Content-Type: multipart/form-data

action=multiapping_fastapiity

WordPress returns a generated field containing an opaque token. The browser sends it to the local gateway and begins a three-step exchange:

1. POST [CID_A, false]
   -> JavaScript containing CID_B

2. POST [CID_B, false]
   -> JavaScript containing filters and CID_C

3. POST [CID_C, true, {filter results}]
   -> final controller decision

Each reply removes the previous injected script, creates another script element, and executes the next response. The controller keeps the browser moving through issued state while its origin stays hidden.

The middle response is the bouncer. It base64-decodes JavaScript templates, runs them through indirect eval, waits for Promises, converts each result to a boolean, and reports the answers.

Two templates in this branch were simple test expressions:

(console.log('t'), true)
(console.log('f'), false)

The engine accepts synchronous and asynchronous checks. The controller can gate delivery on operating system, browser state, prior exposure, interaction, geography, reputation, or campaign timing. It is fussy on purpose.

The tokens keep their shape

Related modules use two stable layouts:

Both begin with the same 16-byte binary prefix and keep fixed lengths across transactions. Route names and token values can rotate. These shapes are harder to repaint.

The first REST request includes a WordPress nonce. Continuation requests use the returned token. Query-string and direct-PHP siblings carry the same state model through different transports.

---

Even the errors rat out the implant

Across 262 requests to the s6qgn route, the gateway returned:

Two recurring bodies expose the server-side handler:

HTTP 403
{"code":"rest_cookie_invalid_nonce","message":"Cookie check failed",...}

HTTP 500
/* Backend request failed */

The 500 response records an upstream relay failure. A 403, 404, or 500 still proves that the malicious handler exists.

Detection should cover every response class, including transactions missing status metadata. The implant was kind enough to fail in several recognizable ways.

---

One framework wears a lot of fake moustaches

The generated names look like a thesaurus fell down the stairs:

platformist-quadendpointer-sxadtr/v1/s6qgn
framework-triappment-xk30rc/v1/s36f8
legacy-macrotrace-a932433ae428/v1/4c53efaff7d2
ultraapiist-pentajavascripter-8oyop7/v1/slk5x
uniserviceist-multiinfrastructure/miniclouder-smartserverless.php
morris_virtual through a vvWr query gateway
short query gateways such as qwcobq=uxpq
site-specific REST namespaces

The newer routes follow a repeatable pattern:

/wp-json/<word-salad>-<12 hex>/v1/<12 hex>

Examples include:

/wp-json/polytransit-macromuxer-c2d72c3a5086/v1/fb33a08c6693
/wp-json/python-datapath-a0d7c2a33ffe/v1/05a07e951e17
/wp-json/macrosketch-interface-e986cc57ae47/v1/edd0de4a1aa3

One infected site loaded six related modules within seconds. Four completed the token, filter, and decision exchange. Two repeatedly returned backend errors. Every malicious request stayed on the compromised origin.

The browser-facing lineage runs from a December 2025 plugin asset and PHP gateway to query gateways in March 2026, the stable s6qgn route in April, and generated REST siblings through July.

Names and transports rotate. The machinery stays recognizable: establish state, call a same-origin gateway, execute its reply, report filter results, then stop or load the next stage.

---

The visitor gate waits for a real person

One successful s6qgn decision returned JavaScript that:

1. Defined window.abcCallback1221.
2. Sent a status beacon to api[.]pimparolix[.]com.
3. Loaded a 64,609-byte obfuscated script from api-ext[.]bixbitemarketing[.]com.

The external script uses a rotating string array and an RC4 decoder. It sends an encrypted-path beacon, registers mousemove and pagehide handlers, and waits. On the eleventh mouse movement, it removes the listener and loads the next encrypted path.

If the page closes first, the loader reports abandonment or its last decision. It also checks:

navigator.webdriver === true
WordPress administrator cookies
large differences between outer and inner window dimensions

The last check is a crude developer-tools tripwire. Automation, a logged-in administrator, or an open console can send the browser down a different path. Ordinary visitors get the sharp end.

---

The infrastructure pins the chain to SocGholish

Four domains connect the gateway to its delivery infrastructure:

Three pivots carry explicit SocGholish tags and sit inside the same gateway flow. datadock[.]info was another loader gate in that operation; ThreatFox currently classifies it as Unknown Loader.

The selected visitor sees the legitimate page replaced by a fake browser update. The download control sends postMessage to a hidden data: iframe. That iframe retrieves embedded JavaScript, creates a blob: URL, and downloads Google Launcher.js.

Proofpoint documents the same chain and identifies its Stage 1 controller as:

js-new[.]newtoyourgame[.]com

GhoLoader is Windows Script Host JScript. It posts to the controller through MSXML2.XMLHTTP and executes the returned JavaScript. The fake update provides the user-assisted bridge from a trusted WordPress page to code execution.

The SocGholish operation remained active through the July 21 cutoff. Its June delivery infrastructure carried current SocGholish tags.

---

The SocGholish gateway becomes a ClickFix precursor

On shared hosts in our dataset, the SocGholish gateway appeared first and ClickFix arrived later. We call this gateway method a ClickFix precursor.

One s6qgn-infected page carried four ClickFix script blocks:

X-Secure Web Metrics 1.6.5
X-Secure Data Flow 1.0.8
X Elite Web Metrics 3.4.9
X-Dynamic Web Metrics 2.0.6

Each block decoded a base64 string, XORed it with a one-byte key, converted the result to text, and ran it with new Function.

All four programs performed the same job:

1. Query a public Polygon RPC endpoint with eth_call.
2. Read an ABI-encoded string from a smart contract.
3. Append a site identifier and minute-based cache value.
4. Inject the resulting URL as a script.

The contract tuple is:

Contract: 0xfD75a8F503be4851E11a52b645De1f017492A6b0
Selector: 0xb68d1809
Method: eth_call
Site ID: ffa65e22169204ca1ac7588970f688d7401d3ffe20656099
Stage: <contract-returned-base>/api.php?s=<site-id>&_v=<unix-minute>

Guardio named this smart-contract staging pattern EtherHiding in 2023 (opens in new tab). We documented the later delivery model in the Artlist ClickFix-to-RAT chain.

Public Polygon RPC services carry the request. Hunt the contract, selector, ABI decoding, and script injection sequence.

The shared hosts remained compromised long enough to receive another delivery kit.

---

Detection follows the protocol

Start with the exact s6qgn route, then widen around behavior. A strong sequence is:

generated action POST to /wp-admin/admin-ajax.php
opaque token returned by WordPress
rapid POSTs to a generated same-origin gateway
X-WP-Nonce on the first REST request
JSON array containing state and a continuation boolean
gateway response inserted into a new script element
filter results returned on the next request

WordPress query routing also exposes the REST route:

/index.php?rest_route=/platformist-quadendpointer-sxadtr/v1/s6qgn

Useful content anchors include:

platformist-quadendpointer-sxadtr
s6qgn
multiapping_fastapiity
T6cSdwTEXsJcDYRlaQf-Iw
PH_PARAM_DIAG
PH_FUNC_DO_REQUEST
PH_VAR_FILTER_DATA
continueWithGatewayRequest
trivueable_autoreactment
pentaapplicationist_quickinfrastructureal
eval(atob(filter.template))

PH_PARAM_DIAG=1 reports the gateway phase, reason, URL, timing, and continuation state.

Cookies from complete related chains include:

wpgq_tds_fail
T6cSdwTEXsJcDYRlaQf-Iw_<generated suffix>
TKEy1GF_N3zKKshz-YDslA_<generated suffix>

Match every response class. The route, token exchange, and returned script behavior remain useful when the controller rejects a visitor or falls over.

---

The fake plugin hides from WordPress

A public WordPress cleanup report from May 2026 (opens in new tab) found the server-side counterpart under:

/wp-content/plugins/platformist-quadendpointer/
platformist-quadendpointer.php

The fake header called it ultravueal reactsion, version 1.8.68. The plugin used junk-comment padding, generated technical word salad, payload retrieval, and backdoor behavior. It also removed itself from the WordPress plugin list. Rude, but effective.

Additional host-search strings include:

ultrainfrastructurely-megaserviceive.php
ultrajavascripting-automicroserviceity.php
includes/vueor-autocloudism.php

Cleanup needs to cover the full account:

1. Compare core, plugins, themes, must-use plugins, uploads, cron, wp-config.php, and server configuration with trusted copies.
2. Search the web root and adjacent account directories for PHP backdoors and hidden fake plugins.
3. Review WordPress administrators, hosting users, database users, SSH/SFTP access, and API keys.
4. Rotate site, hosting, database, file-transfer, and administrator-email credentials. Add MFA and remove unauthorized accounts.
5. Restore from a verified clean backup when possible, then monitor file integrity and authentication events.
6. After removing the gateway, hunt the later ClickFix contract tuple separately.

---

Indicators of compromise

Same-origin routes and strings

/wp-json/platformist-quadendpointer-sxadtr/v1/s6qgn
/index.php?rest_route=/platformist-quadendpointer-sxadtr/v1/s6qgn
/wp-admin/admin-ajax.php action=multiapping_fastapiity
PH_PARAM_DIAG=1
T6cSdwTEXsJcDYRlaQf-Iw
PH_FUNC_DO_REQUEST
PH_VAR_FILTER_DATA
continueWithGatewayRequest
trivueable_autoreactment
pentaapplicationist_quickinfrastructureal
/wp-content/plugins/uniserviceist-multiinfrastructure/assets/analyze.js
/wp-content/plugins/uniserviceist-multiinfrastructure/miniclouder-smartserverless.php
/wp-content/plugins/framework-triappment/assets/hfpb6931.js

Downstream infrastructure

api[.]pimparolix[.]com
api-ext[.]bixbitemarketing[.]com
simplecopseholding[.]com
platform[.]exathomeswebuyarizona[.]com
js-new[.]newtoyourgame[.]com

datadock[.]info/plg

Exact hashes

Exact hashes help with corroboration and old captures. The route and state exchange remain the better primary anchors because token values and response bodies rotate.

ClickFix EtherHiding tuple

Contract: 0xfD75a8F503be4851E11a52b645De1f017492A6b0
Selector: 0xb68d1809
Method: eth_call
Site ID: ffa65e22169204ca1ac7588970f688d7401d3ffe20656099

---

The compromised sites stay useful

SocGholish used the compromised WordPress site as its gateway, visitor filter, and trusted origin. Some hosts later carried ClickFix, making the gateway a useful precursor indicator.

Full cleanup covers the fake plugin, stolen access, persistence, and later injections. The payload changes. The hacked WordPress site keeps serving customers.