Loading malware…
GhoLoader is a JavaScript-based first-stage malware loader used in fake browser update intrusion chains associated with the SocGholish ecosystem. It is commonly delivered after victims visit compromised websites that have been injected with malicious code and are selectively routed through traffic distribution infrastructure, including activity linked to TA2726 and TA569. On Windows systems, victims are typically presented with a fraudulent browser or software update prompt; executing the downloaded script launches GhoLoader, which communicates with attacker-controlled infrastructure and executes returned next-stage code.
GhoLoader functions as an intermediary delivery component rather than the final payload. It has been observed in multi-stage chains that lead to deployment of additional malware including GhostWeaver, AsyncRAT, NetSupport RAT, and ransomware such as LockBit and RansomHub. Reporting also places it within broader TA569 operations historically associated with initial access activity and downstream ransomware enablement. Its role in these chains is to establish contact with command infrastructure, retrieve follow-on content, and execute subsequent stages on the victim host.
The malware is associated with web-based social engineering and drive-by style delivery through compromised legitimate websites, especially CMS-backed sites such as WordPress. These campaigns use filtering and anti-analysis checks to identify suitable victims before presenting fake update lures. GhoLoader is specifically documented as a Windows-stage JScript or WSH-based loader executed by the user after the lure succeeds.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Clicking this button runs a hidden iframe that downloads GhoLoader, a first-stage JScript downloader.
Typically, a TA569 attack chain consists of three parts: the malicious SocGholish injects served to website visitors; a traffic distribution service (TDS) responsible for determining which user receives which payload based on a variety of filtering options; and the ultimate payload, GhoLoader.
13 distinct techniques documented for this family, organized by ATT&CK tactic.
TA2726 turns legitimate WordPress pages into malware delivery infrastructure. A visitor lands on a trusted site, the page runs a three-step eligibility check, and selected Windows users are handed to TA569's SocGholish fake browser update.
TA2726 injects highly obfuscated JavaScript into compromised sites via a fake WordPress plugin... the file “Google Launcher.js” (GhoLoader Stage 1... ) as an embedded base64 blob, constructs it client-side via “URL.createObjectURL()”
...tricking visitors into downloading malicious payloads, commonly disguised as fake browser updates.
GhoLoader is Windows Script Host JScript. It uses MSXML2.XMLHTTP to post to its controller and executes the returned JavaScript.
The downloaded file is GhoLoader Stage 1 — a WSH JScript that POSTs to its C2 via “ActiveXObject('MSXML2.XMLHTTP')” and executes the response.
Loaded an obfuscated script from api-ext[.]bixbitemarketing[.]com... Load the next script from another encrypted path.
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
GhoLoader is a Windows Script Host JScript loader that uses MSXML2.XMLHTTP to post to its controller and execute returned JavaScript, enabling follow-on code execution on Windows.
A JavaScript-based loader delivered by SocGholish that can facilitate deployment of additional payloads.
A staged loader delivered by SocGholish that downloads as a WSH JScript, communicates with command-and-control infrastructure, and executes returned payloads.
A loader delivered by SocGholish that can lead to follow-on payloads including backdoors and ransomware.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.