Police Cleans Nearly 15,000 SocGholish-Infected Sites Tied to Evil Corp

A coordinated international law enforcement operation disrupted the SocGholish (FakeUpdates) JavaScript malware distribution network operated by Evil Corp, disinfecting roughly 15,000 compromised WordPress sites, seizing over 100 servers, and sinkholing command-and-control domains; SocGholish acted as a distributed dropper and initial access broker historically delivering NetSupport RAT and facilitating ransomware, credential theft, and long-term access. Site owners are advised to audit JavaScript and PHP files, check plugins, enable file integrity monitoring or a WAF, and update WordPress components.