#fakeupdates — Public Fediverse posts

Operation Endgame abbatte SocGholish: 100 server offline e 15.000 siti risanati nell’operazione contro Evil Corp

https://insicurezzadigitale.com/operation-endgame-abbatte-socgholish-100-server-offline-e-15-000-siti-risanati-nelloperazione-contro-evil-corp/

🔥 Operation Endgame is back! This latest operation targets #SocGholish (FakeUpdates) malware, used by the notorious criminal group: Evil Corp. It's another major international effort that’s taken down 106 servers and domains, with 14,971 infected WordPress websites remediated.

Excellent work by all partners involved!! 👏 👏

🔧 REMEDIATION: As with previous phases of #OperationEndgame, Spamhaus is proud to support remediation efforts. Website owners affected by this operation will be contacted with guidance on the next steps.

➡️ Dutch National Police press release: https://www.politie.nl/en/news/2026/juni/18/11-international-law-enforcement-initiate-hunt-on-malware-group-socgholish.html
➡️ Operation Endgame: https://operation-endgame.com

#CyberSecurity #ThreatIntelligence #SocGholish #FakeUpdates #Malware #EvilCorp #OperationEndgame

SocGholish Malware Using Compromised Sites to Deliver Ransomware https://hackread.com/socgholish-malware-compromised-sites-ransomware/ #Cybersecurity #CyberAttack #FakeUpdates #SocGholish #Security #Malware #TA569 #MaaS #RAT

Watch out as new research shows SocGholish Malware as Service (MaaS) is exploiting compromised websites and fake software updates to push ransomware and infostealers worldwide.

Read: https://hackread.com/socgholish-malware-compromised-sites-ransomware/

#SocGholish #Malware #FakeUpdates #Ransomware #InfoStealer

FakeUpdates, Remcos, AgentTesla Top Malware Charts in Stealth Attack Surge – Source:hackread.com https://ciso2ciso.com/fakeupdates-remcos-agenttesla-top-malware-charts-in-stealth-attack-surge-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #CyberAttack #FakeUpdates #AgentTesla #Hackread #security #malware #Remcos

FakeUpdates, Remcos, AgentTesla Top Malware Charts in Stealth Attack Surge https://hackread.com/fakeupdates-remcos-agenttesla-malware-attack-charts/ #Cybersecurity #CyberAttack #FakeUpdates #AgentTesla #Security #Malware #Remcos

2024-12-17 (Tuesday): #SmartApeSG injected script leads to fake browser update page, and that page leads to a #NetSupport #RAT infection.

Just like my last post here, there are 2 injected scripts in a page from the compromised site, one using using depostsolo[.]biz and one using tactlat[.]xyz.

A #pcap of the infection traffic, associated malware samples and more information is available at https://www.malware-traffic-analysis.net/2024/12/17/index.html

NetSupportRAT C2 for this campaign continues to be 194.180.191[.]64 since as early as 2024-11-22.

#FakeUpdates #NetSupportRAT

Hackers Exploit Legitimate Websites to Deliver BadSpace Windows Backdoor
https://thehackernews.com/2024/06/hackers-exploit-legitimate-websites-to.html #CyberSecurity #FakeUpdates #WordPress #BackDoor

There's a new player in the 'fake updates' arena. Thanks to @rmceoin for initially posting about it here.

Blog link: https://www.malwarebytes.com/blog/threat-intelligence/2023/07/socgholish-copycat-delivers-netsupport-rat

#FakeUpdates #FakeSG #SocGholish

sync[.]webappclick[.]net is a new #SocGholish / #FakeUpdates "ndsj" TDS. It joins on 45.130.201[.]24 its friend cachespace[.]net still found in the wild from time to time.

I've published the second in a series of blog posts on SocGholish related activity. The latest installment focuses on breaking down the fake update payload itself.

https://rerednawyerg.github.io/malware-analysis/socgholish_part2/

#socgholish #malware #intel #fakeupdates

I've been wanting to start a malware analysis/RE blog as I improve my skills. I published my first analysis a few days ago. Started out by analyzing a site with a malicious JavaScript inject leading to a SocGholish payload.

https://rerednawyerg.github.io/malware-analysis/socgholish/

#socgholish #malware #fakeupdates

On today's #TTILive, we're back at it with some more #Malware Analysis! I have a fresh #FakeUpdates/#SocGholish sample to pick apart. Join the investigation live at 17:00 PST/ 01:00 UTC! https://twitch.tv/mttaggart

#InfoSec #CyberSecurity

The fruit of today's labors: https://otx.alienvault.com/pulse/63b4bfa2cb30ff4a9b202bbe

#FakeUpdates #ThreatIntel #InfoSec #CyberSecurity

#SocGholish #malware #reverseengineering #fakeupdates

This code is a mess! Does anyone have any tips on decoding javascript like this?