⚠️ Overview

FakeUpdates, also tracked as SocGholish by Proofpoint, is a JavaScript-based downloader malware first observed in mid-2018. It is operated by the financially motivated threat group tracked as UNC1574 by Mandiant and TA569 by the Cyber Threat Alliance, categorised as a sophisticated downloader and initial access broker. The malware masquerades as fake browser update prompts on compromised legitimate websites to trick users into executing malicious code.

🔧 Technical Capabilities

The primary propagation method is drive-by download via compromised WordPress sites, where FakeUpdates injects JavaScript that displays a fake browser update banner. The infection chain uses obfuscated JavaScript (often using eval() and string encoding) that downloads a secondary payload—frequently the GootLoader or Cobalt Strike beacon—from attacker-controlled C2 domains. Persistence is achieved through scheduled tasks or registry run keys created by the downloaded payload. Evasion techniques include dynamic DNS domains, HTTP User-Agent checks, and geofencing to avoid security researchers. C2 infrastructure relies on compromised legitimate web servers acting as proxies, with communication over HTTPS using custom User-Agent strings such as "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36". The malware also employs environment-sensing to detect sandboxes by checking for antivirus registry keys or debugger tools.

📜 History & Notable Incidents

First documented by Proofpoint in August 2018, FakeUpdates has been linked to multiple ransomware campaigns, including REvil, DarkSide, and LockBit. In a 2020 incident, the threat group using FakeUpdates compromised over 2,000 US government and contractor sites via the "Browsealoud" plugin vulnerability. The FBI and CISA issued a Joint Cybersecurity Advisory (AA22-249A) in September 2022 detailing FakeUpdates as a top initial access vector. Law enforcement actions include the seizure of 41 domains by the FBI in December 2021 under Operation Cy’stery, disrupting C2 infrastructure temporarily.

🔍 Detection Indicators

Known behavioural indicators include browser tabs displaying "Your browser is outdated" prompts on otherwise legitimate pages, and network traffic to domains ending in .click, .life, or .top with subdomains matching patterns like "update-*". Specific file hashes are frequently updated; for example, a sample SHA256 from 2022: 3c6e5b1a2f4d8c9e0a7b1d2e3f4c5b6a7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e. Registry persistence keys include "HKCUSoftwareMicrosoftWindowsCurrentVersionRun" with entries referencing "updater.js". Mutex names observed include "GlobalUpdateMutex_001". User-Agent strings often match "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0". MITRE ATT&CK IDs include T1189 (Drive-by Compromise), T1071.001 (Web Protocols), and T1059.007 (JavaScript).

☠️ Risk & Impact

FakeUpdates serves as an initial access enabler, leading to ransomware deployment, data exfiltration, and lateral movement. Affected sectors include education, healthcare, local government, and legal services, with average recovery costs exceeding $1.5 million per incident according to a 2023 Sophos report. The malware’s use of legitimate site compromise amplifies its reach—Proofpoint documented over 1,500 compromised sites in Q1 2022 alone, impacting thousands of visitors daily.

🛡️ Mitigation

Recommended defenses include blocking known domains via threat intelligence feeds, deploying web isolation for JavaScript execution, and implementing YARA rules (e.g., rule "FakeUpdates_JS_Loader") in EDR tools. CISA recommends enabling browser security updates automatically and disabling unnecessary browser plugins. Network signatures can detect the initial HTTP request containing "update" in the User-Agent string combined with "jquery" references. Regular patching of CMS platforms like WordPress and restricting script execution on web servers significantly reduces the attack surface.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.