{"id":57173,"date":"2026-06-18T22:47:49","date_gmt":"2026-06-19T02:47:49","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=57173"},"modified":"2026-06-18T22:47:49","modified_gmt":"2026-06-19T02:47:49","slug":"operation-endgame-socgholish-takedown","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/operation-endgame-socgholish-takedown\/","title":{"rendered":"Operation Endgame Seizes 106 Servers in SocGholish Malware Takedown"},"content":{"rendered":"

International law enforcement agencies have dismantled the criminal infrastructure behind SocGholish, a prolific malware framework active since 2017, seizing 106 servers and 101 domains while remediating nearly 15,000 infected websites worldwide. The coordinated takedown, executed as part of Operation Endgame<\/a>, represents the largest international operation ever conducted against ransomware and cybercrime, delivering a significant blow to one of the most persistent malware distribution networks in operation.<\/p>\n

Law enforcement agencies from the Netherlands (NHTCU), Canada (RCMP), the United States (FBI), and Germany (BKA), with support from Europol and Eurojust, conducted a joint action week that crippled SocGholish\u2019s botnet infrastructure. The operation targeted the malware framework commonly known as \u201cFakeUpdates,\u201d which has been responsible for a substantial portion of global malware infections since its emergence in 2017.<\/p>\n

Operation Endgame Delivers Major Blow to SocGholish Infrastructure<\/h2>\n

\u201cWith these actions we deprive cybercriminals of access to infected computer systems. This prevents further damage to the digital systems of citizens, businesses and organizations worldwide,\u201d said Maikel Rollman of the National High Tech Crime Unit (NHTCU). \u201cThis marks the beginning of further action against SocGholish.\u201d The statement underscores that this takedown is not a conclusion but a launching pad for continued enforcement against the criminal network.<\/p>\n

SocGholish, widely known as \u201cFakeUpdates,\u201d is a sophisticated JavaScript malware framework that targets visitors of compromised legitimate websites. Threat actors inject malicious JavaScript into hacked WordPress sites, presenting visitors with convincing fake browser update prompts. Once<\/a> a victim downloads and executes the fake update file, the malware establishes a backdoor connection to attacker-controlled infrastructure, enabling deployment of Remote Access Trojans (RATs), infostealers, Cobalt Strike beacons, and ransomware strains targeting critical infrastructure.<\/p>\n

WordPress, powering over 43% of all websites on the internet, presents an enormous attack surface. In this operation, login credentials from 1.4 million WordPress sites were found to have been leaked, rendering them highly susceptible to SocGholish infection. Authorities confirmed that 14,971 websites, including those of restaurants and auto-garages providing everyday services, were actively infected and have since been remediated.<\/p>\n

How SocGholish Infects Victims Through Fake Browser Updates<\/h2>\n

SocGholish operates by compromising legitimate WordPress websites and injecting malicious JavaScript that displays fake browser update prompts to visitors. These prompts appear convincing, mimicking legitimate browser update notifications. When a user clicks the prompt and downloads the fake update, the malware executes and establishes persistent access to the victim\u2019s system. From there, attackers can deploy additional payloads, including ransomware, information stealers, and remote access tools.<\/p>\n

The Center for Internet Security has identified SocGholish as the top malware downloader globally, accounting for 60% of all such attacks. The malware is linked to Evil Corp, the Russian cybercriminal group previously responsible for the Zeus and Dridex banking malware campaigns and implicated in multiple large-scale ransomware and money-laundering operations.<\/p>\n

What Affected WordPress Site Owners Should Do Now<\/h2>\n

Dutch police removed backdoors and malware from all identified infected WordPress sites and notified affected owners through platforms including HaveIBeenPwned<\/a>, DIVD, Spamhaus, CheckjeHack, NoMoreLeaks, The Shadowserver Foundation, and NCSC Netherlands. Affected WordPress site owners are strongly urged to take immediate action to secure their sites and prevent reinfection.<\/p>\n