The signal that matters.

Operation Endgame Disrupts SocGholish Malware Infrastructure and Cleans 14,971 Sites

International law enforcement agencies disrupted the SocGholish malware operation, taking 106 servers and domains offline and remediating 14,971 compromised websites as part of Operation Endgame. Authorities from the Netherlands, Canada, the United States, and Germany, supported by Europol and Eurojust, targeted infrastructure tied to TA569, the threat actor widely associated with SocGholish, also known as FakeUpdates and GhoLoader. The campaign relied on compromised legitimate websites—especially WordPress and other CMS platforms—to display fake browser update prompts that tricked visitors into installing malware.