International law enforcement agencies removed SocGholish infections from nearly 15,000 WordPress websites and shut down more than 100 servers and domains tied to the botnet. The Operation Endgame action targets infrastructure linked to Evil Corp and aims to disrupt the malware’s infection chain, which has been used to deliver additional payloads since at least 2017. #SocGholish #FakeUpdates #GhoLoader #EvilCorp #OperationEndgame
Keypoints
- Authorities cleaned 14,971 WordPress websites infected with SocGholish.
- More than 100 servers and domains linked to the operation were taken offline.
- The action was part of Operation Endgame with support from Europol and Eurojust.
- SocGholish uses fake browser updates to trick users into installing malware.
- The malware has been associated with Evil Corp and multiple other payloads.