Web threats / Fake browser updates
SocGholish fake browser update
SocGholish, also called FakeUpdates, is a browser-update lure delivered through compromised websites. We have matched its website code on 1,944 sites since 2 August.
SocGholish in numbers
Since 2 August, the first SocGholish match in our records, counted on 12 November 2026. How we count.
| Sites with SocGholish code | 1,944 |
|---|---|
| Sites with a match in the last 30 days | 748 |
| New sites in October | 131 |
| Still serving it when recaptured at least 25 days later | 663 of 819 sites (81%) |
| Sites running WordPress (captured since 25 September) | 88% |
The WordPress gateway and fake update
SocGholish, also called FakeUpdates, is the family name for a fake browser-update operation delivered through compromised websites. Proofpoint attributes the gateway service to TA2726 and the SocGholish delivery to TA569 (Proofpoint).
On the sites we studied, WordPress handles the first part of the chain. An injected script asks admin-ajax.php for a state token, then posts that state to a generated route on the same hostname. The reply becomes a new script element and runs in the page. Two more exchanges carry browser checks and the controller's decision.
infected WordPress page
-> admin-ajax.php returns a state token
-> same-origin gateway returns browser checks
-> results go back through the same gateway
-> controller returns a fake-update loader or stopsThe Platformist framework
The generated names change between infections, but the continuation protocol stays recognizable. One branch calls its request function PH_FUNC_DO_REQUEST, tracks PH_VAR_ATTEMPT and sends a JSON array containing the current state plus a continuation boolean. Another wraps the same framework in a large Base64 data URI.
The server-side counterpart can be a fake plugin hidden from the WordPress plugin list. A documented copy used the directory platformist-quadendpointer and generated technical names throughout its PHP and JavaScript.
Who gets the update
The browser checks are supplied by the controller. They can test operating system, browser state, previous exposure, interaction and geography. A recovered loader waited for an eleventh mouse movement before continuing, and checked navigator.webdriver, WordPress administrator cookies and the difference between the inner and outer window size.
Selected visitors see a browser-update page. Its download control sends a message to a hidden data iframe, which creates a Blob URL and downloads Google Launcher.js.
What we see
| Month | New sites |
|---|---|
| September | 563 |
| October | 131 |
| November so far | 60 |
Of the 819 sites recaptured at least 25 days after their first match, 663 were still serving SocGholish (81%). 88% of SocGholish sites captured since 25 September run WordPress.
Checking a site
Inspect the logged-out page and the server together. Look for:
- generated WordPress REST routes receiving repeated JSON POSTs
PH_FUNC_DO_REQUEST,PH_VAR_ATTEMPT,PH_PARAM_DIAGordata-ph-pid- response text copied into a script element and appended to the page
- a large
data:text/javascript;base64,wrapper around the same framework - fake plugins with generated names that hide from the WordPress plugin list
- a fake browser-update page that downloads
Google Launcher.js
Compare core, plugins, themes, must-use plugins, uploads, cron, wp-config.php and server configuration with trusted copies. Search adjacent account directories for backdoors, review site and hosting users, rotate credentials and check the logged-out page again.