Loading story…
SocGholish (FakeUpdates) infections begin when victims execute a JavaScript browser-update lure from a compromised website, commonly launching wscript.exe through the default Windows Script Host association. In a documented intrusion attributed to initial-access broker TA582, operators performed domain discovery, browser credential theft, NTLM-hash theft, DLL sideloading, staging, and scheduled-task persistence, then maintained access for roughly 30 days. A later operator—suspected, but not confirmed, to be linked to RansomHub—added reverse SSH/proxy persistence, extracted registry hives and credentials, and modified Outlook signatures with malicious SMB URLs to capture NetNTLM hashes; the incident was contained before ransomware deployment.
Post-compromise activity included use of stolen credentials over WinRM, with an injected RtkAudUService64.exe process authenticating to remote systems and wsmprovhost.exe performing reconnaissance, scheduled-task actions, and credential-access-related activity. Detection guidance covers browser-parented wscript.exe, cscript.exe, PowerShell, pwsh, or mshta; script hosts redirecting command output to temporary files; registry changes that disable NTLM sending restrictions for Internal Monologue hash theft; suspicious DNS queries from scripting or native processes; and WinRM-linked scheduled tasks or NTDS/shadow-copy tooling. Organizations should also consider using GPO to associate .js files with a non-executing application such as Notepad, while tuning detections for legitimate administration and automation.
Get the actors, campaigns, and ATT&CK mapping behind it.
10 events from the most recent confirmed update back to the earliest known activity.
ShroudCloud published the stable high-severity Sigma rule “Suspicious DNS Request from High-Risk Process.” It identifies DNS queries by scripting or native Windows processes to specified suspicious TLDs or tunneling and paste-service domains, for potential ClickFix, SocGholish, and similar campaign activity.
ShroudCloud published the stable medium-severity Sigma rule “Script Host Piping Output to Temporary Files.” It detects wscript.exe or cscript.exe spawning command or PowerShell processes that redirect output into .tmp files, a staging pattern observed in FakeUpdates intrusions.
ShroudCloud published the stable, high-severity Sigma rule “Browser Spawning Script or Shell Execution.” The rule detects browsers launching wscript, cscript, PowerShell, pwsh, or mshta, including the FakeUpdates pattern in which Chrome launches Update.js.
ShroudCloud published the stable high-severity Sigma rule “NTLM Hash Theft via Internal Monologue.” It detects registry changes setting RestrictSendingNTLMTraffic to DWORD value 0, which can weaken NTLM restrictions and enable hash extraction without directly accessing LSASS.
The intrusion was stopped before the suspected ransomware operator performed actions on objectives or deployed a ransomware payload.
The later-stage operator modified Outlook HTML signature files to include attacker-controlled file:// SMB URLs, causing recipients’ email clients to attempt SMB authentication. This could expose NetNTLM hashes for theft or relay attacks and aid email-contact reconnaissance.
The operator created SYSTEM scheduled tasks including Update, which used ssh.exe for a reverse SSH tunnel over port 443, and fontdrvr1, which executed a Python script; libffi and libfi were additional persistence names. The actor also injected RtkAudUService64.exe, used WinRM for remote reconnaissance and scheduled-task activity, accessed shadow copies and registry hives, and again copied browser credential data.
After an approximately 30-day dwell period, a second operator—suspected but not confirmed to be a RansomHub affiliate—took over the intrusion and conducted network, account, session, and administrative-share discovery.
The SocGholish/FakeUpdates activity on a domain-joined host performed discovery, browser credential collection, and Internal Monologue NTLM-hash theft. It established persistence with OneDriveStandaloneUpdater and python-pip scheduled tasks, prepared DLL sideloading, and installed an embedded Python environment.
A Canadian outdoor magazine WordPress site was compromised and injected with traffic-distribution JavaScript. A visitor clicked an “Update Browser” prompt, causing Chrome to launch wscript.exe and execute the downloaded Update.js payload.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
10 references tracked. Mallory keeps watching after this page renders.
shroudcloud.io
Open sourceshroudcloud.io
Open sourceshroudcloud.io
Open sourceresearch.nccgroup.com
Open sourceshroudcloud.io
Open sourcemedium.com
Open sourceredcanary.com
Open sourceesentire.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported continued abuse of **fake browser and software update pages** on compromised websites to trick Windows users into installing malware, with multiple investigations tying the lure to delivery of **NetSupport Manager RAT** and broader **SocGholish/FakeUpdates** activity. Trellix described a campaign in which injected JavaScript redirected visitors to counterfeit Chrome update pages, then launched a staged infection chain using JavaScript, batch files, VBScript, `curl`, and a portable **7-Zip** utility to install NetSupport while avoiding PowerShell. Mandiant documented a similar chain in which a disguised archive and scripts unpacked NetSupport from `%AppData%`, established persistence through startup shortcuts and registry artifacts, and enabled remote desktop control, file transfer, system inventory, application launch, and geolocation.
Aug 15, 2026
Russian state-linked threat actors have leveraged the SocGholish (also known as FakeUpdates) JavaScript loader to target U.S.-based organizations, including a civil engineering company with ties to Ukraine. SocGholish, operated by TA569, acts as an initial access broker by distributing fake browser update alerts on compromised websites, tricking users into downloading malicious JavaScript that installs additional malware. In a recent campaign, the RomCom threat actor used SocGholish to deliver the Mythic Agent malware, marking the first observed instance of this payload being distributed via SocGholish. The activity has been attributed with medium-to-high confidence to Unit 29155 of Russia's GRU, highlighting the ongoing use of sophisticated malware delivery chains for both cybercrime and espionage. The attacks exploit vulnerabilities in website plugins to inject malicious code, and SocGholish's services are known to be used by various threat groups, including Evil Corp, LockBit, Dridex, and Raspberry Robin. The campaign underscores the evolving tactics of Russian-aligned actors in targeting U.S. entities through layered malware distribution strategies.
Jun 29, 2026
The SocGholish malware-as-a-service (MaaS) platform, also known as FakeUpdates, has been leveraged by threat group TA569 to distribute ransomware and information-stealing malware through weaponized software updates. Attackers compromise legitimate websites, particularly vulnerable WordPress sites, and use techniques such as domain shadowing to create malicious subdomains on trusted domains. These compromised sites are then used to deliver fake software updates, tricking users into downloading malware payloads including RansomHub and LockBit ransomware, AsyncRAT, and various infostealers. SocGholish acts as an initial access broker, selling access to its infection methods to other criminal groups, including Evil Corp and Russian state-backed actors. Recent campaigns have involved distributing RansomHub ransomware via malicious Google Ads impersonating the HR portal of Kaiser Permanente, resulting in significant breaches at organizations such as Rite Aid and Change Healthcare. The platform's ability to facilitate a range of payloads and its use by multiple threat actors underscore its ongoing threat to organizations worldwide.
Jul 12, 2026