SocGholish
O que é SocGholish?
SocGholishA JavaScript-based fake-browser-update loader operated by TA569, served from thousands of compromised WordPress sites and used as the initial-access stage for ransomware affiliates including Evil Corp and BlackCat.
SocGholish (a Proofpoint name; also called FakeUpdates) is a JavaScript-based malware framework operated by the threat actor TA569, in continuous activity since 2018 and one of the most prolific initial-access vectors of 2023–2025. Operators compromise WordPress and other CMS-hosted sites at scale via plug-in vulnerabilities or credential reuse, then inject a small loader that profiles the visitor and, for matching targets, redirects to a fake browser-update page (Chrome, Firefox, Edge, Safari) hosting a malicious ZIP. The ZIP contains a JavaScript that fingerprints the host, optionally drops a stealer (NetSupport RAT, AsyncRAT, info-stealers), or hands off to ransomware affiliates including Evil Corp (WastedLocker, LockBit, BlackBasta) and BlackCat. SocGholish increasingly chains with ClickFix-style instructions in 2024–2025, asking the victim to paste a PowerShell command from the fake-update page. Defenses include browser-update warnings (modern browsers update silently and never display in-page update prompts), web-filtering on sites known to be SocGholish-served, blocking JavaScript execution from user-downloaded ZIPs, and EDR rules on the loader's PowerShell stages.
● Exemplos
- 01
A user visits a compromised WordPress recipe blog; SocGholish profiles the browser and serves a `chrome_update.js` payload that drops NetSupport RAT.
- 02
A ransomware affiliate receives access from TA569 a few days after an initial SocGholish loader infection and deploys BlackBasta the following week.
● Perguntas frequentes
O que é SocGholish?
A JavaScript-based fake-browser-update loader operated by TA569, served from thousands of compromised WordPress sites and used as the initial-access stage for ransomware affiliates including Evil Corp and BlackCat. Pertence à categoria Malware da cibersegurança.
O que significa SocGholish?
A JavaScript-based fake-browser-update loader operated by TA569, served from thousands of compromised WordPress sites and used as the initial-access stage for ransomware affiliates including Evil Corp and BlackCat.
Como funciona SocGholish?
SocGholish (a Proofpoint name; also called FakeUpdates) is a JavaScript-based malware framework operated by the threat actor TA569, in continuous activity since 2018 and one of the most prolific initial-access vectors of 2023–2025. Operators compromise WordPress and other CMS-hosted sites at scale via plug-in vulnerabilities or credential reuse, then inject a small loader that profiles the visitor and, for matching targets, redirects to a fake browser-update page (Chrome, Firefox, Edge, Safari) hosting a malicious ZIP. The ZIP contains a JavaScript that fingerprints the host, optionally drops a stealer (NetSupport RAT, AsyncRAT, info-stealers), or hands off to ransomware affiliates including Evil Corp (WastedLocker, LockBit, BlackBasta) and BlackCat. SocGholish increasingly chains with ClickFix-style instructions in 2024–2025, asking the victim to paste a PowerShell command from the fake-update page. Defenses include browser-update warnings (modern browsers update silently and never display in-page update prompts), web-filtering on sites known to be SocGholish-served, blocking JavaScript execution from user-downloaded ZIPs, and EDR rules on the loader's PowerShell stages.
Como se defender contra SocGholish?
As defesas contra SocGholish costumam combinar controles técnicos e práticas operacionais, conforme detalhado na definição acima.
Quais são outros nomes para SocGholish?
Nomes alternativos comuns: FakeUpdates, TA569.
● Termos relacionados
- malware№ 692
Loader
Malware que prepara o ambiente e carrega cargas posteriores — frequentemente diretamente em memória — para a fase seguinte de um ataque.
- attacks№ 398
Download drive-by
Ataque em que malware é instalado silenciosamente no dispositivo da vítima simplesmente por visitar um site comprometido ou malicioso.
- defense-ops№ 597
Initial Access Broker (IAB)
Especialista cibercriminoso que obtem acesso nao autorizado a redes empresariais e o vende a outros criminosos, sobretudo afiliados de ransomware.
- attacks№ 199
ClickFix Attack
A 2024-vintage social-engineering lure that displays a fake CAPTCHA, error dialog, or 'verify you're human' page instructing the victim to paste a pre-copied PowerShell command into Run, delivering info-stealers or loaders.
- malware№ 1006
Ransomware como serviço (RaaS)
Modelo de negócio criminoso em que os operadores de ransomware alugam o seu malware e infraestrutura a afiliados que executam os ataques e partilham os lucros.
- attacks№ 1352
Ataque do bebedouro (watering hole)
Ataque direcionado que compromete um site frequentado por um grupo específico de utilizadores para os infetar quando o visitam.