Authorities Seize 106 Servers and 101 Domains in Major SocGholish Malware Takedown

International law enforcement agencies have successfully seized 106 servers and 101 domains as part of a coordinated global effort against the SocGholish malware infrastructure, marking a major milestone in Operation Endgame.

Announced on June 18, 2026, from The Hague, this operation targeted a crucial infection chain exploited by cybercriminal groups, including the infamous Russia-linked group Evil Corp.

Authorities from the Netherlands National High Tech Crime Unit (NHTCU), the FBI, Germany’s BKA, and the Royal Canadian Mounted Police (RCMP), supported by Europol and Eurojust, carried out a joint action week that disrupted significant parts of the SocGholish ecosystem while remediating 14,971 compromised websites worldwide.

SocGholish Malware Takedown

SocGholish, also known as “FakeUpdates,” is a long-running malware campaign active since 2017 that primarily exploits compromised WordPress websites to deliver malicious payloads.

By injecting fake browser update prompts into legitimate websites, attackers trick users into downloading malware, granting initial access to their systems. This foothold is often used to deploy secondary payloads, including ransomware strains linked to attacks on critical infrastructure.

The scale of the threat is amplified by WordPress’s global dominance, powering over 43% of all websites. Recent findings indicating that login credentials for approximately 1.4 million WordPress sites have been leaked further underscore the widespread exposure and risk of infection.

During the operation, authorities not only dismantled command-and-control infrastructure by taking over domains and shutting down servers but also conducted large-scale remediation of infected websites.

This included removing malicious scripts and backdoors from compromised WordPress installations and notifying affected site owners. Victim notification efforts were coordinated through multiple cybersecurity organizations and platforms, including HaveIBeenPwned, Spamhaus, DIVD, Shadowserver Foundation, and the Netherlands’ National Cyber Security Center (NCSC).

These efforts aimed to ensure that administrators take immediate action to secure their environments and prevent reinfection.

Maikel Rollman of the NHTCU emphasized the broader impact of the operation, stating that disrupting access to infected systems significantly reduces the risk of further cyberattacks against businesses, citizens, and critical infrastructure.

He noted that this takedown represents the beginning of sustained actions against SocGholish-linked operations. In parallel, authorities urged WordPress site owners to implement essential security measures, including updating credentials, enabling multi-factor authentication, removing unauthorized accounts, and keeping software up to date.

The campaign also highlights the evolving collaboration between public law enforcement and private cybersecurity entities. Operation Endgame, launched in 2024, is one of the greatest international efforts against cybercrime, involving multiple countries, including the United States, the United Kingdom, France, Australia, and others.

The initiative focuses on dismantling ransomware and malware ecosystems through intelligence sharing, infrastructure disruption, and coordinated legal actions.

SocGholish’s association with Evil Corp adds further significance to the takedown, as the group has been linked to major financial malware families such as Zeus and Dridex, as well as extensive ransomware and money laundering operations.

By targeting both infrastructure and infection vectors, Operation Endgame demonstrates a strategic shift toward proactively disrupting cybercriminal supply chains, limiting their ability to scale attacks and monetize compromised systems globally.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.