Fake browser updates turn a trusted website into a download prompt.
A fake browser update is a download lure injected into a compromised website. It selects visitors, replaces the page with an update prompt and asks them to run a file. Since 1 August we have matched fake-update code on 1,944 sites.
Fake browser updates in numbers
Since 1 August, when our rule-match records begin, counted on 12 November 2026. How we count.
| Sites with fake-update code | 1,944 |
|---|---|
| Sites with a match in the last 30 days | 748 |
| New sites in October | 131 |
| Still serving a fake update when recaptured at least 25 days later | 663 of 819 sites (81%) |
| Sites running WordPress (captured since 25 September) | 88% |
What the infected sites run
837 of the 946 sites we captured since 25 September 2026 run WordPress (88%). Shares below are of the WordPress sites, by the version and plugins on each site's latest capture.
| WordPress version | Sites | Share |
|---|---|---|
| WordPress 7.1 | 457 | 55% |
| WordPress 7.0 | 67 | 8% |
| WordPress 6.9 | 50 | 6% |
| WordPress 6.8 | 44 | 5% |
| Other releases from 6.0 | 46 | 5% |
| Older than 6.0 | 26 | 3% |
| Rare or unreadable version | 147 | 18% |
| Plugin | Sites | Share |
|---|---|---|
elementor | 277 | 33% |
contact-form-7 | 224 | 27% |
framework-triappment | 160 | 19% |
woocommerce | 123 | 15% |
elementor-pro | 116 | 14% |
revslider | 101 | 12% |
google-site-kit | 76 | 9% |
wordpress-seo | 71 | 8% |
akismet | 68 | 8% |
wpforms-lite | 53 | 6% |
wordfence | 51 | 6% |
A fake browser update is a download prompt placed on a compromised website. The injected code checks the visitor, covers or replaces the page with an update notice and gives selected Windows visitors a file to run.
compromised website
-> injected browser gateway
-> visitor and browser checks
-> fake update page
-> JavaScript file created for downloadThe website acts as the gateway
The SocGholish implementation we track begins on WordPress. Its browser code asks the site for an opaque state token and makes a series of POST requests to a generated route on the same hostname. The server relays those requests to a controller and returns JavaScript for the browser to run.
Those first requests look like traffic to the website the visitor chose. The controller can test the operating system, browser state, previous exposure, interaction and geography before it returns the lure. One recovered loader waited for mouse movement and checked for browser automation, an open developer console and WordPress administrator cookies.
The update file is built in the browser
The selected visitor sees a browser-update prompt in place of the page. In the SocGholish chain, the download control talks to a hidden data iframe. That frame creates a Blob URL and starts a download named Google Launcher.js.
Proofpoint attributes this gateway role to TA2726 and the fake-update delivery to TA569, the operator it tracks with SocGholish (Proofpoint). The same June report describes Operation Endgame disrupting TA569. We captured the chain still delivering Google Launcher.js to selected visitors through 21 July 2026.
What we see across infected sites
| Month | New sites |
|---|---|
| September | 563 |
| October | 131 |
| November so far | 60 |
88% of the fake-update sites captured since 25 September run WordPress. Of the 819 sites recaptured at least 25 days after their first match, 663 still served fake-update code (81%).
Checking a site
Check the public page while logged out, in a fresh browser profile. Then inspect the page source, loaded scripts and server files for:
- rapid POST requests to a generated same-origin REST route
- response text inserted into new script elements
PH_FUNC_DO_REQUEST,PH_VAR_ATTEMPTorPH_PARAM_DIAG- Base64 data-script wrappers around a large continuation framework
- a WordPress plugin or must-use plugin missing from the dashboard list
- a prompt that creates a JavaScript download through a Blob URL
Search WordPress core, plugins, themes, must-use plugins, uploads, cron and wp-config.php against trusted copies. Review WordPress administrators, hosting users, database users and file-transfer access. Remove the gateway and hidden plugin, rotate the affected credentials and test the logged-out page again.
Kits
SocGholish
748 sites in the last 30 days
SocGholish, also called FakeUpdates, is a browser-update lure delivered through compromised websites.