Police cleans nearly 15,000 SocGholish-infected sites tied to Evil Corp
International law enforcement cleaned 14,971 SocGholish-infected WordPress sites and shut down 106 servers tied to Evil
International law enforcement agencies from the Netherlands, Canada, the US, and Germany successfully removed SocGholish malware from nearly 15,000 compromised WordPress websites and disabled 106 servers and domains as part of Operation Endgame. SocGholish, a JavaScript-based malware downloader also known as FakeUpdates and GhoLoader, has been used since 2017 to hijack legitimate sites and trick users into installing malicious payloads disguised as browser updates. The operation targeted Evil Corp, a Russian cybercrime group linked to major ransomware families including WastedLocker, Hades, and Phoenix CryptoLocker.
AI summary of the linked source. Not reviewed by an editor. How this works
Run WordPress?
Get an email when a new story names WordPress, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe SocGholish campaign exploited poorly maintained WordPress installations to inject malicious JavaScript that tricked end users into downloading malware disguised as legitimate browser updates. The root problem is twofold: website owners failed to keep WordPress core, plugins, and themes patched and hardened, while end users lacked the awareness to distinguish genuine browser update prompts from social engineering lures. This allowed Evil Corp to quietly build a massive distribution network for ransomware families over several years before law enforcement intervention. The scale of the compromise — nearly 15,000 sites — illustrates how unmanaged web assets become force multipliers for criminal operations, and how user-facing deception can bypass technical controls entirely.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — SocGholish
- malware — Dridex
- malware — Doppelpaymer
- malware — WastedLocker
- malware — Hades
- malware — Phoenix CryptoLocker