FAKEUPDATESMalware
- FakeUpdate
- gholoader
- SocGholish
FAKEUPDATES is a downloader written in JavaScript that communicates via HTTP. Supported payload types include executables and JavaScript. It writes the payloads to disk prior to launching them. FAKEUPDATES has led to further compromise via additional malware families that include CHTHONIC, DRIDEX, EMPIRE, KOADIC, DOPPELPAYMER, and AZORULT.From MISP Galaxy
Last reported 9 days ago, by Silent Push10 reports
ATT&CK techniques
6 of 21 · each with the sentence it comes from- T1684Social Engineering
“He added, “A vast percentage of social engineering, business email compromise, and credential harvesting attacks leverage lookalike or typo-squatted domains, tracking these external threats serves as a powerful indicator of an organization’s overall cyber hygiene and threat lands…”
- T1036Masquerading
“SocGholish is a malware framework that uses social engineering, where cybercriminals masquerading as trustworthy entities trick users into performing harmful actions such as clicking malicious links, or in the case of SocGholish, downloading infected updates.”
- T1055Process Injection
“Deploy and tune EDR/XDR solutions to detect PowerShell misuse, process injection, and abnormal auto registry modifications.”
- T1564.003Hidden Window
“It executes in a hidden window (-w 1) and bypasses execution policies (-ep Unrestricted).”
- T1027Obfuscated Files or Information
“T1027.010Command ObfuscationUsed obfuscated powershell commands”
- T1027.006HTML Smuggling
“HTML Smuggling Tradecraft”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
10 reports, newest first · the exact sentence from each-
Silent Push Says Impersonation Monitoring Belongs In Underwriting“The published examples span FIN7, Lazarus, PoisonSeed, FakeUpdate, Keitaro C2, and SecTopRAT.”
-
Cyber Brief 26-07 - June 2026“…s Cybersecurity reserve, while Europol and law enforcement from several countries coordinated under Operation Endgame to dismantle the SocGholish malware network.”
-
Dissecting CrashFix: KongTuke's New Toy“KongTuke appears to have taken notes from SocGholish's playbook, adopting a layered obfuscation approach, though with considerably less sophistication.”
-
Unmasking MuddyWater’s New Malware Toolkit Driving International Espionage“The loader was identified as FakeUpdate, which is an injector-style loader that decrypts an embedded second-stage payload using Advanced Encryption Standard (AES) and injects it into its own process.”
-
ClickFix: The Social Engineering Technique Hackers Use to Manipulate Victims“The Center for Internet Security has separately recorded ClickFix campaigns pushing SocGholish, a JavaScript downloader distributed through fake browser update pages.”
-
2024: Revisiting a Year in Threats“BOINC Software Exploited by SocGholish”
-
Fake Browser Updates Lead to BOINC Volunteer Computing Software“SocGholish or FakeUpdates.”
-
Navigate SocGholish with Huntress“Navigate SocGholish with Huntress”
-
BLISTER Loader“Our research shows that BLISTER is actively developed and has been linked in public reporting to LockBit ransomware and the SocGholish framework; in addition, Elastic has also observed BLISTER in relation to the following families: Amadey, BitRAT, Clipbanker, Cobalt Strike, Remco…”
-
Prometheus TDS“…tracted by Group-IB’s analysts indicates that a similar pattern is also used to distribute malware such as Campo Loader, IcedID, QBot, SocGholish, and Buer Loader.”
Indicators in its reports
named in the reports above- 158.247.252[.]178in 1 report
- 170.168.103[.]208in 1 report
- hxxps://github[.]com/uBlockOrigin/uBOL-homein 1 report
- hxxps://nexsnield[.]com/install?uuid=550e8400-e29b-41d4-a716-446655440000&version=2025.1116.1842in 1 report
- nexsnield[.]comin 1 report
- hxxps://nexsnield[.]com/update?uuid=550e8400-e29b-41d4-a716-446655440000&version=2025.1116.1842&previous=2025.1115.1000in 1 report
- hxxp://199.217.98[.]108/bin 1 report
- 199.217.98[.]108in 1 report
- hxxp://fyvw2oiv[.]top/1.php?s=63e95be1-92e0-45c1-a928-65d63b17cd1cin 1 report
- fyvw2oiv[.]topin 1 report
- hxxps://gist.githubusercontent[.]com/RussianPanda95/cb9c57145f4b6afbc08f24a19257ed5a/raw/e1be0cc7b7e58e4205920c019d786db636036a4c/kongtuke_dga.txtin 1 report
- hxxp://temp[.]sh/utDKu/138d2a62b73e89fc4d09416bcefed27e139ae90016ba4493efc5fbf43b66acfa.exein 1 report
- hxxps://gist.githubusercontent[.]com/RussianPanda95/54725bf9a7809ef480fc5e35a7521137/raw/d0a0e04504fa0e1e91850be141c9bb23608b73d7/aes256_cbc.txtin 1 report
- hxxps://gist.githubusercontent[.]com/RussianPanda95/6aa1e36457d6dbc09ff7dd218c7c223b/raw/5e186b23d4eecd7b3b99f8b88178545ade747cd8/example.txtin 1 report
- hxxps://gist.githubusercontent[.]com/RussianPanda95/71164efdc4d7e816b385551b38ada5ca/raw/2c9baaf2105dc7f730c6d562472780bd5535c32d/xor.txtin 1 report
- fbfce492d1aa458c…7f59db67de67in 1 report
- 6399c686eba09584…7ce7c27752f4in 1 report
- hxxps://www.dropbox[.]com/scl/fi/6gscgf35byvflw4y6x4i0/b1.zip?rlkey=bk2hvxvw53ggzhbjiftppej50&st=yyxnfu71&dl=1in 1 report
- c15f44d6abb3a2a8…bfba5832c8c6in 1 report
- c46af9ae6ab0e756…45fe7640199cin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.