Loading story…
International law enforcement agencies disrupted the SocGholish malware operation, taking 106 servers and domains offline and remediating 14,971 compromised websites as part of Operation Endgame. Authorities from the Netherlands, Canada, the United States, and Germany, supported by Europol and Eurojust, targeted infrastructure tied to TA569, the threat actor widely associated with SocGholish, also known as FakeUpdates and GhoLoader. The campaign relied on compromised legitimate websites—especially WordPress and other CMS platforms—to display fake browser update prompts that tricked visitors into installing malware.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
In the Operation Endgame action targeting infrastructure linked to SocGholish, Amadey, and StealC, Europol said authorities seized more than EUR 41 million in criminal cryptocurrency assets. The seizure was described as part of a coordinated international law-enforcement effort against malware networks supporting ransomware and other cybercrime.
On 2026-06-18, Have I Been Pwned added an Operation Endgame 4.0 breach entry after authorities supplied data from the SocGholish takedown. The dataset contained 154,000 impacted email addresses and more than 500,000 previously unseen passwords.
On 2026-06-18, Shadowserver published a one-off special report tied to the SocGholish Operation Endgame action to notify affected WordPress site owners. The report included remediation guidance such as changing credentials, enabling MFA, removing unauthorized accounts, and patching WordPress and plugins.
On 2026-06-18, law enforcement agencies from the Netherlands, Canada, the United States, and Germany, supported by Europol and Eurojust, announced a coordinated disruption of TA569/SocGholish as part of Operation Endgame. The action took 106 servers and domains offline and remediated 14,971 compromised websites tied to the malware operation.
Proofpoint states it has tracked TA569 since 2018, identifying it as a major operator using compromised websites and fake browser update lures to deliver SocGholish and related payloads.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
19 references tracked. Mallory keeps watching after this page renders.
decipher.sc
Open sourcemalware.news
Open sourcedarkreading.com
Open sourcexakep.ru
Open sourcepolitie.nl
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourceproofpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An Operation Endgame action disrupted the **SocGholish** malware ecosystem by remediating **14,971 compromised websites** and dismantling associated command-and-control infrastructure, according to Orange Cyberdefense. SocGholish, a JavaScript-based downloader linked to the Russian-speaking initial access broker **TA569** and also tracked as **UNC1543**, **Mustard Tempest**, and **GOLD PRELUDE**, has compromised legitimate websites since at least 2017 and used fake browser update prompts to infect visitors. The malware has frequently served as an entry point for follow-on payloads including **Gholoader**, **MintsLoader**, **GhostWeaver**, **AsyncRAT**, **NetSupport RAT**, and ransomware operations such as **LockBit** and **RansomHub**. The disruption targeted a broader cybercrime chain tied to traffic distribution services such as **TA2726**, with reporting also noting copycat activity from **TA2727** distributing **Lumma** and **DeerStealer**, as well as links into the wider financially motivated ecosystem around **Evil Corp**. Defenders were warned that TA569 is likely to rebuild because SocGholish infrastructure rotates rapidly, often every **2 to 5 days**, making continued monitoring essential. Recommended mitigations included patching internet-facing CMS platforms, strengthening credentials, enabling **MFA**, and training users to distrust unsolicited browser update pop-ups that are commonly used as infection lures.
Jun 29, 2026
Researchers reported that threat actor **TA2726** used a malicious traffic-distribution framework on **1,509 compromised WordPress sites** to turn them into malware delivery gateways. The operation relied on injected fake-plugin JavaScript, `admin-ajax` bootstrapping, and same-origin REST or query endpoints to profile visitors and selectively redirect them based on geography and device type. Eligible Windows users were funneled into **TA569’s SocGholish** fake browser update chain, which led to **GhoLoader** execution, while the broader ecosystem has also routed victims to other payloads including **Lumma Stealer**, **DeerStealer**, **Marcher**, and the macOS stealer **FrigidStealer**. Proofpoint previously identified TA2726 as a malicious traffic distribution service working alongside other actors, including **TA2727**, in web inject campaigns that abuse compromised websites and fake browser update lures across **Windows, Android, and macOS**. In the newer WordPress-focused activity, the observed `s6qgn` implant remained active from April through July 2026 even after disruption efforts against parts of the SocGholish ecosystem, and some infected sites were later repurposed for a separate **ClickFix** injection using **Polygon EtherHiding** smart-contract lookups. The findings indicate a resilient and increasingly collaborative fake-update ecosystem in which shared infrastructure and compromised websites are reused to deliver multiple malware families and complicate attribution.
Jul 22, 2026
International law enforcement and industry partners expanded **Operation Endgame** to dismantle malware infrastructure tied to infostealers, botnets, remote access trojans, and ransomware enablement. Europol said a 2025 follow-up used a database seized in the 2024 takedown to identify customers of the **Smokeloader** pay-per-install botnet, resulting in five detentions and interrogations, house searches, arrest warrants, and so-called knock-and-talk actions across Europe and North America. Investigators said access bought through Smokeloader was used for keylogging, webcam access, cryptomining, and ransomware deployment, signaling that authorities are now pursuing not only operators but also downstream criminal users. Dutch police later reported another coordinated Endgame action that included the arrest in Greece of a main suspect linked to **VenomRAT**, 11 searches, the takedown of **1,025 servers**, and the seizure of **20 domains**. Authorities said the disrupted malware families had infected more than **600,000 victims** worldwide and enabled the theft of tens of millions of records; stolen user data was secured and made inaccessible, with victims directed to a police portal to check exposed credentials. Separate technical reporting on **DanaBot** described the malware-as-a-service platform as a stealthy, multi-tier operation with roughly 150 active C2 servers per day across more than 40 countries, and said its disruption under **Operation Endgame II** was the most significant blow to the botnet to date.
Aug 15, 2026