#socgholish — Public Fediverse posts

Dropcatch Scavengers: Expired Malicious Domains Become Cash Cows

Three financially motivated threat actors acquire expired malicious domains through dropcatch to inherit traffic from previously compromised websites. Stuffy Squirrel specializes in hiding activity within legitimate scripts and has operated since 2020, selling traffic to affiliate advertising networks. Shady Squirrel uses custom JavaScript and Keitaro injections with multi-step cloaking, partnering with initial access brokers to deliver tech support scams and SocGholish malware, notably facilitating SocGholish's return within weeks of Operation Endgame disruption. Swiping Squirrel, the most prolific actor, operates in greyhat territory by selling fraudulent traffic to zero-click advertising platforms like ZeroPark, often resulting in malvertising and malware distribution. These actors control thousands of domains collectively, exploiting lingering infections from previous compromises without conducting new attacks themselves.

Pulse ID: 6a7ec3107e8b34f88b5d610e
Pulse Link: https://otx.alienvault.com/pulse/6a7ec3107e8b34f88b5d610e
Pulse Author: AlienVault
Created: 2026-08-14 07:26:08

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #Java #JavaScript #Malvertising #Malware #OTX #OpenThreatExchange #RAT #SocGholish #Squirrel #bot #AlienVault

Dropcatch Scavengers: Expired Malicious Domains Become Cash Cows

Three financially motivated threat actors acquire expired malicious domains through dropcatch to inherit traffic from previously compromised websites. Stuffy Squirrel specializes in hiding activity within legitimate scripts and has operated since 2020, selling traffic to affiliate advertising networks. Shady Squirrel uses custom JavaScript and Keitaro injections with multi-step cloaking, partnering with initial access brokers to deliver tech support scams and SocGholish malware, notably facilitating SocGholish's return within weeks of Operation Endgame disruption. Swiping Squirrel, the most prolific actor, operates in greyhat territory by selling fraudulent traffic to zero-click advertising platforms like ZeroPark, often resulting in malvertising and malware distribution. These actors control thousands of domains collectively, exploiting lingering infections from previous compromises without conducting new attacks themselves.

Pulse ID: 6a7ec3107e8b34f88b5d610e
Pulse Link: https://otx.alienvault.com/pulse/6a7ec3107e8b34f88b5d610e
Pulse Author: AlienVault
Created: 2026-08-14 07:26:08

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #Java #JavaScript #Malvertising #Malware #OTX #OpenThreatExchange #RAT #SocGholish #Squirrel #bot #AlienVault

Dropcatch Scavengers: Expired Malicious Domains Become Cash Cows

Three financially motivated threat actors acquire expired malicious domains through dropcatch to inherit traffic from previously compromised websites. Stuffy Squirrel specializes in hiding activity within legitimate scripts and has operated since 2020, selling traffic to affiliate advertising networks. Shady Squirrel uses custom JavaScript and Keitaro injections with multi-step cloaking, partnering with initial access brokers to deliver tech support scams and SocGholish malware, notably facilitating SocGholish's return within weeks of Operation Endgame disruption. Swiping Squirrel, the most prolific actor, operates in greyhat territory by selling fraudulent traffic to zero-click advertising platforms like ZeroPark, often resulting in malvertising and malware distribution. These actors control thousands of domains collectively, exploiting lingering infections from previous compromises without conducting new attacks themselves.

Pulse ID: 6a7ec3107e8b34f88b5d610e
Pulse Link: https://otx.alienvault.com/pulse/6a7ec3107e8b34f88b5d610e
Pulse Author: AlienVault
Created: 2026-08-14 07:26:08

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #Java #JavaScript #Malvertising #Malware #OTX #OpenThreatExchange #RAT #SocGholish #Squirrel #bot #AlienVault

Dropcatch Scavengers: Expired Malicious Domains Become Cash Cows

Three financially motivated threat actors acquire expired malicious domains through dropcatch to inherit traffic from previously compromised websites. Stuffy Squirrel specializes in hiding activity within legitimate scripts and has operated since 2020, selling traffic to affiliate advertising networks. Shady Squirrel uses custom JavaScript and Keitaro injections with multi-step cloaking, partnering with initial access brokers to deliver tech support scams and SocGholish malware, notably facilitating SocGholish's return within weeks of Operation Endgame disruption. Swiping Squirrel, the most prolific actor, operates in greyhat territory by selling fraudulent traffic to zero-click advertising platforms like ZeroPark, often resulting in malvertising and malware distribution. These actors control thousands of domains collectively, exploiting lingering infections from previous compromises without conducting new attacks themselves.

Pulse ID: 6a7ec3107e8b34f88b5d610e
Pulse Link: https://otx.alienvault.com/pulse/6a7ec3107e8b34f88b5d610e
Pulse Author: AlienVault
Created: 2026-08-14 07:26:08

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #Java #JavaScript #Malvertising #Malware #OTX #OpenThreatExchange #RAT #SocGholish #Squirrel #bot #AlienVault

Dropcatch Scavengers: Expired Malicious Domains Become Cash Cows

Three financially motivated threat actors acquire expired malicious domains through dropcatch to inherit traffic from previously compromised websites. Stuffy Squirrel specializes in hiding activity within legitimate scripts and has operated since 2020, selling traffic to affiliate advertising networks. Shady Squirrel uses custom JavaScript and Keitaro injections with multi-step cloaking, partnering with initial access brokers to deliver tech support scams and SocGholish malware, notably facilitating SocGholish's return within weeks of Operation Endgame disruption. Swiping Squirrel, the most prolific actor, operates in greyhat territory by selling fraudulent traffic to zero-click advertising platforms like ZeroPark, often resulting in malvertising and malware distribution. These actors control thousands of domains collectively, exploiting lingering infections from previous compromises without conducting new attacks themselves.

Pulse ID: 6a7ec3107e8b34f88b5d610e
Pulse Link: https://otx.alienvault.com/pulse/6a7ec3107e8b34f88b5d610e
Pulse Author: AlienVault
Created: 2026-08-14 07:26:08

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #Java #JavaScript #Malvertising #Malware #OTX #OpenThreatExchange #RAT #SocGholish #Squirrel #bot #AlienVault

Not the right person to action this yourself? ➡️ Forward this to whoever handles abuse reports or security escalations at your company.

It takes less than 5 minutes to pull the list and get started 🙏

#Trustandsafety #SocGholish #Remediation

3/3

Not the right person to action this yourself? ➡️ Forward this to whoever handles abuse reports or security escalations at your company.

It takes less than 5 minutes to pull the list and get started 🙏

#Trustandsafety #SocGholish #Remediation

3/3

Not the right person to action this yourself? ➡️ Forward this to whoever handles abuse reports or security escalations at your company.

It takes less than 5 minutes to pull the list and get started 🙏

#Trustandsafety #SocGholish #Remediation

3/3

Not the right person to action this yourself? ➡️ Forward this to whoever handles abuse reports or security escalations at your company.

It takes less than 5 minutes to pull the list and get started 🙏

#Trustandsafety #SocGholish #Remediation

3/3

Not the right person to action this yourself? ➡️ Forward this to whoever handles abuse reports or security escalations at your company.

It takes less than 5 minutes to pull the list and get started 🙏

#Trustandsafety #SocGholish #Remediation

3/3

📢 ENDGAME REMEDIATION - SOCGHOLISH | Following last week’s announcement and today’s update from Europol (link below), the disruption effort against SocGholish has expanded to include Amadey and StealC.

Spamhaus is now sending notification emails 📩 to hosters of confirmed compromised WordPress sites.

Here's what to do if you receive one:

👉 Go to this remediation webpage: https://www.spamhaus.org/endgame-socgholish
👉 Enter the access code included in the email
👉 Download the list of compromised WordPress administrator credentials
👉 Verify and where necessary, contact the owner to update their credentials, enable multi-factor authentication, remove any unrecognised WordPress accounts, and ensure your WordPress installation is fully up to date. (there's a ready-made email template for you to use on the remediation webpage 😀)

Thank you to everyone who is part of this effort.

Europol announcement: https://www.europol.europa.eu/media-press/newsroom/news/global-cyber-strike-disrupts-socgholish-amadey-and-stealc-malware-networks

#Trustandsafety #Endgame #SocGholish #Disruption #Infosec #CyberSecurity #Malware

📢 ENDGAME REMEDIATION - SOCGHOLISH | Following last week’s announcement and today’s update from Europol (link below), the disruption effort against SocGholish has expanded to include Amadey and StealC.

Spamhaus is now sending notification emails 📩 to hosters of confirmed compromised WordPress sites.

Here's what to do if you receive one:

👉 Go to this remediation webpage: https://www.spamhaus.org/endgame-socgholish
👉 Enter the access code included in the email
👉 Download the list of compromised WordPress administrator credentials
👉 Verify and where necessary, contact the owner to update their credentials, enable multi-factor authentication, remove any unrecognised WordPress accounts, and ensure your WordPress installation is fully up to date. (there's a ready-made email template for you to use on the remediation webpage 😀)

Thank you to everyone who is part of this effort.

Europol announcement: https://www.europol.europa.eu/media-press/newsroom/news/global-cyber-strike-disrupts-socgholish-amadey-and-stealc-malware-networks

#Trustandsafety #Endgame #SocGholish #Disruption #Infosec #CyberSecurity #Malware

🕵🏻‍♂️ [InfoSec MASHUP] 25/2026 - Client-Side Authorization Is Not Authorization

BobDaHacker didn't find a zero-day. She didn't exploit a memory corruption bug or chain together three CVEs. She uploaded a photo of her ID to FIFA's public agent registration portal, got added to FIFA's #Microsoft Entra tenant, and walked straight into the live production Streaming Management panel for the #FIFA World Cup 2026. Every match. Every camera angle. Every RTMP stream key. One click away from replacing the PGM feed — the main broadcast output going to every TV network worldwide — with whatever she felt like pushing. She did not push anything. She spent the rest of the night calling FIFA, MediaKind, HBS, CISA, and the FBI trying to get someone to pick up the phone.

The root cause is almost insultingly mundane: client-side authorization with no server-side enforcement. The Angular frontend checked the JWT, found no roles, showed an "access denied" page. The backend APIs didn't check anything. FIFA fixed it by the next morning without ever responding to the researcher. She's still on their official match document distribution list, receiving Start Lists and Tactical Lineups in four languages. The vulnerability is gone. The bug bounty program, the security.txt file, and the acknowledgment to the person who saved them from a global broadcast catastrophe remain absent. Client-side authorization is not authorization. It's 2026.

→ Week #25/2026 also covers: The #SocGholish botnet is down after nine years, Texas leaked 3M driver's licenses and passports, and dozens of cybersecurity vets are calling the #Anthropic ban dangerous

Full issue 👉 https://infosec-mashup.santolaria.net/p/infosec-mashup-25-2026-client-side-authorization-is-not-authorization

If you find it useful, subscribe to get it in your inbox every weekend 📨

#infosecMASHUP #cybersecurity #infosec #threatintel #AI

🕵🏻‍♂️ [InfoSec MASHUP] 25/2026 - Client-Side Authorization Is Not Authorization

BobDaHacker didn't find a zero-day. She didn't exploit a memory corruption bug or chain together three CVEs. She uploaded a photo of her ID to FIFA's public agent registration portal, got added to FIFA's #Microsoft Entra tenant, and walked straight into the live production Streaming Management panel for the #FIFA World Cup 2026. Every match. Every camera angle. Every RTMP stream key. One click away from replacing the PGM feed — the main broadcast output going to every TV network worldwide — with whatever she felt like pushing. She did not push anything. She spent the rest of the night calling FIFA, MediaKind, HBS, CISA, and the FBI trying to get someone to pick up the phone.

The root cause is almost insultingly mundane: client-side authorization with no server-side enforcement. The Angular frontend checked the JWT, found no roles, showed an "access denied" page. The backend APIs didn't check anything. FIFA fixed it by the next morning without ever responding to the researcher. She's still on their official match document distribution list, receiving Start Lists and Tactical Lineups in four languages. The vulnerability is gone. The bug bounty program, the security.txt file, and the acknowledgment to the person who saved them from a global broadcast catastrophe remain absent. Client-side authorization is not authorization. It's 2026.

→ Week #25/2026 also covers: The #SocGholish botnet is down after nine years, Texas leaked 3M driver's licenses and passports, and dozens of cybersecurity vets are calling the #Anthropic ban dangerous

Full issue 👉 https://infosec-mashup.santolaria.net/p/infosec-mashup-25-2026-client-side-authorization-is-not-authorization

If you find it useful, subscribe to get it in your inbox every weekend 📨

#infosecMASHUP #cybersecurity #infosec #threatintel #AI

Civilians behind international police probe into Russian cybercriminals

https://fed.brid.gy/r/https://globalnews.ca/news/11915435/russian-cybercriminals-scam-wordpress/

Operation #Endgame putzt #SocGholish #Malware von #WordPress Blogs und schaltet Server ab.

https://borncity.com/blog/2026/06/20/operation-endgame-schaltet-socgholish-malware-infrastruktur-ab/

Operation #Endgame putzt #SocGholish #Malware von #WordPress Blogs und schaltet Server ab.

https://borncity.com/blog/2026/06/20/operation-endgame-schaltet-socgholish-malware-infrastruktur-ab/

Cyber Journaal S02E73, het Ministerie van Financiën gehackt via een zeroday, de politie rolt het SocGholish netwerk op en bijna 74.000 Fortinet firewalls liggen op straat. https://www.ccinfo.nl/journaal/3235079_financien-gehackt-via-zeroday-politie-rolt-socgholish-op #Cybersecurity #SocGholish #FortiBleed

Fazit: Hätte man Updates zeitnah eingespielt, wäre die Wahrscheinlichkeit geringer gewesen kompromittiert zu werden.

#OperationEndgame: Ermittler säubern tausende Blogs von #SocGholish | Security https://www.heise.de/news/Operation-Endgame-Ermittler-saeubern-tausende-Blogs-von-SocGholish-11337399.html #malware

Fazit: Hätte man Updates zeitnah eingespielt, wäre die Wahrscheinlichkeit geringer gewesen kompromittiert zu werden.

#OperationEndgame: Ermittler säubern tausende Blogs von #SocGholish | Security https://www.heise.de/news/Operation-Endgame-Ermittler-saeubern-tausende-Blogs-von-SocGholish-11337399.html #malware

#Police cleans nearly 15,000 #SocGholish-infected sites tied to #EvilCorp

https://www.bleepingcomputer.com/news/security/law-enforcement-nukes-socgholish-malware-from-nearly-15-000-sites/

#OperationEndgame #cybercrime #cybersecurity

#Police cleans nearly 15,000 #SocGholish-infected sites tied to #EvilCorp

https://www.bleepingcomputer.com/news/security/law-enforcement-nukes-socgholish-malware-from-nearly-15-000-sites/

#OperationEndgame #cybercrime #cybersecurity

Operation Endgame abbatte SocGholish: 100 server offline e 15.000 siti risanati nell’operazione contro Evil Corp

https://insicurezzadigitale.com/operation-endgame-abbatte-socgholish-100-server-offline-e-15-000-siti-risanati-nelloperazione-contro-evil-corp/

Operation Endgame abbatte SocGholish: 100 server offline e 15.000 siti risanati nell’operazione contro Evil Corp

https://insicurezzadigitale.com/operation-endgame-abbatte-socgholish-100-server-offline-e-15-000-siti-risanati-nelloperazione-contro-evil-corp/

📣🚨 #OperationEndgame disrupts TA569’s SocGholish malware infrastructure, with law enforcement taking down 100+ C2 servers and cleaning 15,000 hacked sites.

Read: https://hackread.com/operation-endgame-disrupts-socgholish-malware/

#SocGholish #Malware #Cybersecurity #CyberCrime #Ransomware #TA569

📣🚨 #OperationEndgame disrupts TA569’s SocGholish malware infrastructure, with law enforcement taking down 100+ C2 servers and cleaning 15,000 hacked sites.

Read: https://hackread.com/operation-endgame-disrupts-socgholish-malware/

#SocGholish #Malware #Cybersecurity #CyberCrime #Ransomware #TA569

🔥 Operation Endgame is back! This latest operation targets #SocGholish (FakeUpdates) malware, used by the notorious criminal group: Evil Corp. It's another major international effort that’s taken down 106 servers and domains, with 14,971 infected WordPress websites remediated.

Excellent work by all partners involved!! 👏 👏

🔧 REMEDIATION: As with previous phases of #OperationEndgame, Spamhaus is proud to support remediation efforts. Website owners affected by this operation will be contacted with guidance on the next steps.

➡️ Dutch National Police press release: https://www.politie.nl/en/news/2026/juni/18/11-international-law-enforcement-initiate-hunt-on-malware-group-socgholish.html
➡️ Operation Endgame: https://operation-endgame.com

#CyberSecurity #ThreatIntelligence #SocGholish #FakeUpdates #Malware #EvilCorp #OperationEndgame

🔥 Operation Endgame is back! This latest operation targets #SocGholish (FakeUpdates) malware, used by the notorious criminal group: Evil Corp. It's another major international effort that’s taken down 106 servers and domains, with 14,971 infected WordPress websites remediated.

Excellent work by all partners involved!! 👏 👏

🔧 REMEDIATION: As with previous phases of #OperationEndgame, Spamhaus is proud to support remediation efforts. Website owners affected by this operation will be contacted with guidance on the next steps.

➡️ Dutch National Police press release: https://www.politie.nl/en/news/2026/juni/18/11-international-law-enforcement-initiate-hunt-on-malware-group-socgholish.html
➡️ Operation Endgame: https://operation-endgame.com

#CyberSecurity #ThreatIntelligence #SocGholish #FakeUpdates #Malware #EvilCorp #OperationEndgame

New season of #OperationEndgame just dropped.
This time, they targeted #SocGholish.
106 servers and domains taken down, 14.971 websites remediated.
Of course, they released a movie like video for it again.
Press release: https://www.politie.nl/en/news/2026/juni/18/11-international-law-enforcement-initiate-hunt-on-malware-group-socgholish.html
#OpEndgame #SocGholish

New season of #OperationEndgame just dropped.
This time, they targeted #SocGholish.
106 servers and domains taken down, 14.971 websites remediated.
Of course, they released a movie like video for it again.
Press release: https://www.politie.nl/en/news/2026/juni/18/11-international-law-enforcement-initiate-hunt-on-malware-group-socgholish.html
#OpEndgame #SocGholish

Cyberattacks Against the US Intensify as Russian Groups Target Engineering Firm https://thecyberexpress.com/cyberattacks-against-the-us/ #CenterforCounteringDisinformation #cyberattacksagainsttheUS #TheCyberExpressNews #TheCyberExpress #FirewallDaily #SocGholish #CyberNews #RomCom

Cyberattacks Against the US Intensify as Russian Groups Target Engineering Firm https://thecyberexpress.com/cyberattacks-against-the-us/ #CenterforCounteringDisinformation #cyberattacksagainsttheUS #TheCyberExpressNews #TheCyberExpress #FirewallDaily #SocGholish #CyberNews #RomCom

New RomCom campaign observed using SocGholish to deliver the Mythic Agent payload. Targets: U.S. organizations supporting Ukraine. Researchers also link the operation to GRU Unit 29155.

Full report:
https://www.technadu.com/russian-aligned-romcom-uses-socgholish-to-deploy-mythic-agent-on-ukraine-supporters-in-new-campaign-linked-to-gru-unit-29155/614627/

#infosec #ThreatIntel #RomCom #SocGholish #Malware #MythicAgent #GRU

Russian RomCom Utilizing SocGholish to Deliver Mythic Agent to U.S. Companies Supporting Ukraine
#RomComGroup #SocGholish #TA569
https://arcticwolf.com/resources/blog/romcom-utilizing-socgholish-to-deliver-mythic-agent-to-usa-companies-supporting-ukraine/

Russian RomCom Utilizing SocGholish to Deliver Mythic Agent to U.S. Companies Supporting Ukraine
#RomComGroup #SocGholish #TA569
https://arcticwolf.com/resources/blog/romcom-utilizing-socgholish-to-deliver-mythic-agent-to-usa-companies-supporting-ukraine/

SocGholish Malware Using Compromised Sites to Deliver Ransomware https://hackread.com/socgholish-malware-compromised-sites-ransomware/ #Cybersecurity #CyberAttack #FakeUpdates #SocGholish #Security #Malware #TA569 #MaaS #RAT

SocGholish Malware Using Compromised Sites to Deliver Ransomware https://hackread.com/socgholish-malware-compromised-sites-ransomware/ #Cybersecurity #CyberAttack #FakeUpdates #SocGholish #Security #Malware #TA569 #MaaS #RAT

Watch out as new research shows SocGholish Malware as Service (MaaS) is exploiting compromised websites and fake software updates to push ransomware and infostealers worldwide.

Read: https://hackread.com/socgholish-malware-compromised-sites-ransomware/

#SocGholish #Malware #FakeUpdates #Ransomware #InfoStealer

Watch out as new research shows SocGholish Malware as Service (MaaS) is exploiting compromised websites and fake software updates to push ransomware and infostealers worldwide.

Read: https://hackread.com/socgholish-malware-compromised-sites-ransomware/

#SocGholish #Malware #FakeUpdates #Ransomware #InfoStealer

SocGholish Malware Spread via Ad Tools; Delivers Access to LockBit, Evil Corp, and Others – Source:thehackernews.com https://ciso2ciso.com/socgholish-malware-spread-via-ad-tools-delivers-access-to-lockbit-evil-corp-and-others-sourcethehackernews-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #TheHackerNews #SocGholish

SocGholish Malware Spread via Ad Tools; Delivers Access to LockBit, Evil Corp, and Others – Source:thehackernews.com https://ciso2ciso.com/socgholish-malware-spread-via-ad-tools-delivers-access-to-lockbit-evil-corp-and-others-sourcethehackernews-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #TheHackerNews #SocGholish

@filippo the copy/paste technique is called #ClickFix . the site in the image is infected by TA2726's Keitaro which is well known for sending Windows folks to #SocGholish . what they do with macOS folks has changed over the years. i see they sent you to something that delivered what looks like Poseidon Stealer.

https://medium.com/@MateoPappa/letsdefend-poseidon-macos-stealer-hard-a796c85d8c72

@filippo the copy/paste technique is called #ClickFix . the site in the image is infected by TA2726's Keitaro which is well known for sending Windows folks to #SocGholish . what they do with macOS folks has changed over the years. i see they sent you to something that delivered what looks like Poseidon Stealer.

https://medium.com/@MateoPappa/letsdefend-poseidon-macos-stealer-hard-a796c85d8c72

SocGholish: From loader and C2 activity to RansomHub deployment
#SocGholish #RansomHubRansomware
https://www.darktrace.com/blog/socgholish-from-loader-and-c2-activity-to-ransomhub-deployment

We’re seeing an increasing volume of blocked queries to the SocGholish-related domain - blackshelter[.]org in the last several days.

#DNS #SocGholish #ransomware #malware #infosec

Notorious Malware, Spam Host “Prospero” Moves to Kaspersky Lab

https://krebsonsecurity.com/2025/02/notorious-malware-spam-host-prospero-moves-to-kaspersky-lab/

#InterisleConsultingGroup #Ne'er-Do-WellNews #ALittleSunshine #TheComingStorm #KasperskyLab #ProsperoOOO #ZachEdwards #Ransomware #GootLoader #Securehost #SilentPush #SocGholish #Intrinsec #AlfaBank #BEARHOST #spamhaus #Kentik

Notorious Malware, Spam Host “Prospero” Moves to Kaspersky Lab https://krebsonsecurity.com/2025/02/notorious-malware-spam-host-prospero-moves-to-kaspersky-lab/ #InterisleConsultingGroup #Ne'er-Do-WellNews #ALittleSunshine #TheComingStorm #KasperskyLab #ProsperoOOO #ZachEdwards #Ransomware #GootLoader #Securehost #SilentPush #SocGholish #Intrinsec #AlfaBank #BEARHOST #spamhaus #Kentik