Netskope Threat Labs

SocGholish

ATP Sandbox Adv. HeuristicsNetskope IPS

Description

SocGholish (a.k.a. FakeUpdater) is a JavaScript based malware delivery framework that impersonates browser update prompts to trick visitors of compromised websites into running its downloader. Users encounter the fake update dialog during normal browsing, and the script fetches payloads such as Dridex, Azorult, and remote access tools for downstream crews. Its access to legitimate web traffic has made it a leading initial access broker for ransomware operations.

Stats

First seen
April 2022
Last seen
October 2026

Also known as

FakeUpdatesSocgholish

MITRE ATT&CK techniques

19 techniques across 7 tactics.

TA0001 Initial Access

TA0002 Execution

TA0005 Stealth

TA0007 Discovery

  • T1016System Network Configuration Discovery
  • T1033System Owner/User Discovery
  • T1057Process Discovery
  • T1082System Information Discovery
  • T1482Domain Trust Discovery
  • T1518Software Discovery
  • T1614System Location Discovery

TA0009 Collection

TA0011 Command and Control

TA0010 Exfiltration

  • T1048Exfiltration Over Alternative Protocol
    • T1048.003Exfiltration Over Unencrypted Non-C2 Protocol

Associated groups

Alert name variants

Alert Name
Document-HTML.Dropper.SocGholish
Document-HTML.Malware.SocGholish
Document-HTML.Trojan.SocGholish
Package.Trojan.FakeUpdates
Script-JS.Downloader.FakeUpdates
Script-JS.Malware.SocGholish
Script-JS.Trojan.FakeUpdates
Script-JS.Trojan.Socgholish
Script-JS.Trojan.SocGholish
Script.Trojan.SocGholish

Related IPS Signatures

Signature Name
MALWARE-CNC UNC1543.FAKEUPDATES C2 check-in detected

Related families

BazarLatrodectusQakBotGrandoreiroInvisibleFerret

References