Loading malware…
SocGholish, also known as FakeUpdates, is a JavaScript-based malware loader and distribution framework targeting Microsoft Windows environments. Documented since 2018, it provides initial access for financially motivated cybercriminal operations and retrieves and executes additional payloads, including Cobalt Strike and AsyncRAT.
Distribution primarily involves compromised legitimate websites displaying fraudulent browser-update prompts. Visitors are persuaded to download and execute malicious JavaScript, often packaged in ZIP archives. Windows Script Host executes the loader, which establishes command-and-control communications. Election-themed phishing campaigns have also delivered SocGholish. Operators use traffic distribution systems, including Keitaro, to route visitors and filter researcher or sandbox traffic.
SocGholish profiles infected endpoints, collecting user and computer identities, domain membership, operating-system and hardware information, running processes, and installed security products. It supports arbitrary command execution, additional payload delivery, and exfiltration of collected information and command output. Discovery commonly extends to domain controllers, domain trusts, privileged groups, and Active Directory systems. Command output is staged in temporary files before transmission. Obfuscated JavaScript and legitimate Windows utilities help conceal malicious activity. Observed infection chains have established scheduled-task persistence for Python-based follow-on components.
SocGholish operations have been associated with Evil Corp and the initial access broker Exotic Lily. The Water Scylla intrusion set uses SocGholish to facilitate access for RansomHub affiliates, and confirmed SocGholish-origin intrusions have led to LockBit deployment. Follow-on operators have conducted browser credential theft, registry-hive extraction, tunneling, and lateral movement. Victims span multiple industries, including government, banking, consulting, legal services, retail, and hospitality, with substantial activity in the United States.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
And furthermore, this particular variation of injection was used by many massive website infection campaigns, including the attacks following the infamous Drupalgeddon 2. | This NDSW/NDSX malware — also referred to as FakeUpdates or SocGholish by other research groups — is responsible for redirecting site visitors to malicious pages designed to trick victims into loading and installing fake browser updates.
This occurred via the SocGholish JavaScript framework, found earlier this year on dozens of hacked newspaper sites owned by the same company.
CVE-2026-41940, the cPanel authentication bypass, illustrates the opportunistic mass-exploitation pattern most clearly. What began as exploratory probing evolved into a multi-actor campaign combining ransomware deployment, website defacement, and — in at least one documented case — targeted cyber-espionage. | We also now increasingly observe this vulnerability within attack chains of threat actors that rely on compromising legitimate websites via web inject, such as TA569 (SocGholish).
20 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“This particular intrusion set is tracked by Trend Micro under the name Water Scylla, whose activities lead to RansomHub ransomware deployment.”
The infamous SocGholish (aka FakeUpdates) is a JavaScript-based loader that targets Microsoft Windows-based environments.
Initial access was achieved through a SocGholish infection. Following this, Cobalt Strike was loaded onto the host and command-and-control (C2) established.
The “SocGholish” (aka FakeUpdates) malware distribution framework ... Just in January, we’ve identified and responded to two discrete “hands-on-keyboard” intrusions traced back to a SocGholish compromise.
The SocGholish malware often poses as a browser update. When users visit sites that have been compromised, they are prompted to install the update.
The review covers a SocGholish (FakeUpdates) intrusion initiated when a user visited a compromised WordPress site and executed Update.js delivered through a fake browser-update prompt.
33 distinct techniques documented for this family, organized by ATT&CK tactic.
The ingress of Python to establish persistence with a scheduled task (T1053.005) is new for SocGholish.
SocGholish uses PowerShell run Reconnaissance commands and deploy Backdoors.
SocGholish Tasks executed ipconfig /all command to network configuration and settings.
SocGholish Tasks are executed to discover level groups and permissions.
285 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named malware distributed through cybercrime-as-a-service infrastructure that Microsoft disrupted in an earlier operation. This reference does not describe its functionality.
Microsoft had previously dismantled cybercrime-as-a-service infrastructure belonging to gangs distributing SocGholish, Amadey and StealC malware.
Malware framework associated here with compromised websites and downstream delivery via dropcaught malicious domains.
Malware receiving inherited infection traffic from expired malicious domains acquired by Shady Squirrel.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.