Skuggaheimar/Threat Intelligence/SocGholish
SOCGHOLISH
SOCGHOLISH
MALWARE LOADER
TA569 / EVIL CO
Threat IntelligenceMalwareSeptember 17, 2025•15 min read

SocGholish: Threat Intelligence Profile

JavaScript-based fake update framework

Scroll

SocGholish / FakeUpdates (also known as SocGholish, FakeUpdates) is a malware loader active since 2017. JavaScript-based fake update framework. Key characteristics include: fake browser updates, compromised WordPress sites, Evil Corp/TA569 distribution, delivers NetSupport/Cobalt Strike.

Overview & Background

JavaScript-based fake update framework. First identified in 2017, this threat is attributed to TA569 / Evil Corp.

Threat Assessment

SocGholish remains an active threat. Organizations should implement detection rules and monitor for indicators associated with this malware loader.

Technical Analysis

SocGholish employs the following capabilities and techniques:

MITRE ATT&CK Mapping

TacticTechniqueUsage
Initial AccessT1566.001 Phishing AttachmentCommon delivery vector
ExecutionT1204.002 Malicious FileUser-triggered execution
PersistenceT1547.001 Registry Run KeysAutostart persistence
Defense EvasionT1027 Obfuscated FilesPayload obfuscation
C2T1071.001 Web ProtocolsHTTP/HTTPS C2

Detection & Defense

Defend Against SocGholish

Mjolnir Security provides detection and response capabilities against SocGholish and similar threats.

Threat DetectionIncident ResponseThreat HuntingMDR ServicesThreat Intelligence
  • Proactive Threat Hunting Hunt for SocGholish indicators and TTPs within your environment.
  • Threat Intelligence Monitor SocGholish campaigns and infrastructure changes.
  • 24/7 Incident Response Rapid containment and forensic investigation. Call +1 833 403 5875.
Written by: Mjolnir Security  |  Published: September 17, 2025
Related Reports
Malware

Latrodectus: IcedID Successor

Read Report →
Malware

SystemBC: Ransomware Enabler

Read Report →