Loading malware…
SocGholish, also known as FakeUpdates, is a JavaScript-based malware loader and initial-access framework targeting Windows systems. Active since approximately 2017, it is distributed through compromised legitimate websites, including WordPress sites, that display fraudulent browser-update prompts. Visitors are induced to download or execute malicious JavaScript, sometimes packaged in ZIP archives. Its delivery infrastructure uses injected scripts, traffic-distribution systems, and domain shadowing to exploit trusted websites and selectively route potential victims.
SocGholish profiles infected systems, checks domain membership, performs host and Active Directory reconnaissance, and deploys secondary payloads. Infection chains can involve Windows script hosts and PowerShell. Documented SocGholish intrusions have included process injection, scheduled-task persistence, browser credential extraction, NTLM-hash theft through the Internal Monologue technique, and lateral movement through Windows Remote Management. These intrusion-stage activities may be performed by operators or follow-on tooling rather than by the initial JavaScript loader itself.
SocGholish is associated with the financially motivated TA569 operation and serves an initial-access ecosystem that enables subsequent data theft and ransomware deployment. Historical follow-on payloads include Cobalt Strike and WastedLocker ransomware; other chains have delivered BLISTER and MYTHIC implants. SocGholish infections have also been linked to Evil Corp activity. Operators adopted MintsLoader as an alternative delivery chain around July 2024, distributing it through fake browser-update overlays on compromised websites. The malware targets website visitors and enterprise endpoints, with domain-joined systems providing opportunities for further organizational compromise.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
And furthermore, this particular variation of injection was used by many massive website infection campaigns, including the attacks following the infamous Drupalgeddon 2. | This NDSW/NDSX malware — also referred to as FakeUpdates or SocGholish by other research groups — is responsible for redirecting site visitors to malicious pages designed to trick victims into loading and installing fake browser updates.
This occurred via the SocGholish JavaScript framework, found earlier this year on dozens of hacked newspaper sites owned by the same company.
CVE-2026-41940, the cPanel authentication bypass, illustrates the opportunistic mass-exploitation pattern most clearly. What began as exploratory probing evolved into a multi-actor campaign combining ransomware deployment, website defacement, and — in at least one documented case — targeted cyber-espionage. | We also now increasingly observe this vulnerability within attack chains of threat actors that rely on compromising legitimate websites via web inject, such as TA569 (SocGholish).
18 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The SocGholish malware often poses as a browser update. When users visit sites that have been compromised, they are prompted to install the update.
The SocGholish malware often poses as a browser update. When users visit sites that have been compromised, they are prompted to install the update.
The review covers a SocGholish (FakeUpdates) intrusion initiated when a user visited a compromised WordPress site and executed Update.js delivered through a fake browser-update prompt.
Shady Squirrel ... sends traffic to initial access brokers and cybercriminals like SocGholish ... SocGholish is believed to have regained access to thousands of compromised sites by teaming up with the threat actor merely days after its infrastructure was disrupted in a law enforcement operation.
This NDSW/NDSX malware — also referred to as FakeUpdates or SocGholish by other research groups — is responsible for redirecting site visitors to malicious pages designed to trick victims into loading and installing fake browser updates.
Recorded Future exploits TDS to demonstrate a high-level activity strategy that includes regularly updating URLs embedded in WordPress sites, adding additional servers, and improving TDS logic to evade detection, and has been linked to SocGholish and D3F@ck Loader malware, as well as the Rhysida and Interlock ransomware groups.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
266 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Microsoft had previously dismantled cybercrime-as-a-service infrastructure belonging to gangs distributing SocGholish, Amadey and StealC malware.
Malware framework associated here with compromised websites and downstream delivery via dropcaught malicious domains.
Malware receiving inherited infection traffic from expired malicious domains acquired by Shady Squirrel.
Malware traffic recipient associated with scavenged expired malicious domains.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.