Operation Endgame Disrupts SocGholish Servers, Cleans 14,971 WordPress Sites

Law enforcement from multiple countries disrupted SocGholish infrastructure as part of Operation Endgame, taking down 106 servers and cleaning nearly 15,000 infected WordPress sites. The report outlines SocGholish's multi-stage JavaScript loader framework, extensive affiliate/TDS ecosystem (traffic sellers, Keitaro/zTDS), use of domain shadowing and webinjects, and its role delivering diverse follow-on payloads (ransomware, loaders, RATs) to victims across many sectors and countries.