Operation Endgame Disrupts SocGholish Campaign, Cleaning Nearly 15,000 Compromised WordPress Sites

A major international law enforcement effort, dubbed Operation Endgame, has successfully disrupted a key cybercriminal infrastructure behind the SocGholish malware campaign. Coordinated actions led to the seizure of servers central to the operation and the remediation of 14,971 WordPress websites that had been infected with malicious scripts. This shows how coordinated global action can blunt the impact of persistent threats affecting website owners and end users alike.

SocGholish, also tracked as FakeUpdates, is a malware distribution framework that primarily uses fake browser update notifications to trick visitors into downloading malicious payloads. Attackers often compromise legitimate WordPress sites by exploiting outdated plugins, themes, or weak administrator credentials. Once inside, they inject JavaScript code that displays convincing pop-ups urging users to update their browser – but the “update” is actually a trojanized installer leading to ransomware, information stealers, or remote access trojans.

The removal of SocGholish code from nearly 15,000 WordPress sites highlights the scale of this problem. For website owners, an infected site not only endangers visitors but also risks blacklisting by search engines and loss of trust. This takedown temporarily reduces the attack surface, but the underlying vulnerabilities that allowed the compromises remain. Site administrators must remain vigilant: routine updates, strong passwords, and regular security audits are essential to prevent reinfection.

For site owners, choosing a managed WordPress hosting platform like AEU Hosting that includes automated malware scanning and hardening can provide an extra layer of defense against such widespread threats. While no single solution guarantees complete protection, proactive measures significantly lower the risk of becoming the next statistic in a mass compromise campaign.