Police dismantle SocGholish botnet infecting 15,000 WordPress sites

A multinational law enforcement effort has disrupted one of the largest malware distribution networks targeting WordPress sites. The operation, conducted under the umbrella of Operation Endgame, removed SocGholish malware from nearly 15,000 compromised websites and took offline more than 100 servers linked to the Russian cybercrime group Evil Corp. Authorities from the Netherlands, Canada, the United States, and Germany collaborated in the takedown, which marks a significant blow to a malware family active since at least 2017.

What happened

On 18 June 2026, law enforcement agencies announced the results of a coordinated action against the SocGholish botnet, a JavaScript-based malware downloader also known as FakeUpdates and GhoLoader. The Dutch National High Tech Crime Unit (NHCTU) led the technical effort to clean 14,971 infected WordPress sites, while authorities in the U.S., Canada, and Germany took down 106 servers and domains used to control the botnet. The operation was supported by Europol and Eurojust, reflecting the cross-border nature of the threat.

SocGholish operates by hijacking legitimate WordPress sites and injecting malicious code that tricks visitors into downloading fake browser updates. Once installed, the malware establishes a connection to attackers, allowing them to deploy additional payloads, including ransomware and banking trojans. The malware has been linked to multiple high-profile cybercrime campaigns, including the distribution of Dridex, Doppelpaymer, and WastedLocker ransomware.

Why it matters

The takedown of SocGholish represents a significant disruption to Evil Corp’s operations, which have long relied on the malware to distribute ransomware and other malicious payloads. By removing the malware from nearly 15,000 sites, law enforcement has not only reduced the immediate threat to visitors but also weakened the group’s ability to launch future attacks. The operation also highlights the growing collaboration between international agencies to combat cybercrime, particularly when it involves infrastructure hosted across multiple jurisdictions.

For website owners, the operation serves as a reminder of the importance of securing WordPress installations. The Dutch police advised affected site owners to change credentials, enable multi-factor authentication, remove unknown user accounts, and ensure their sites are updated to the latest version. Failure to do so could leave sites vulnerable to reinfection or exploitation by other threat actors.

What to watch

While the operation has dealt a blow to SocGholish, law enforcement has indicated that this is only the beginning of further actions against the malware and its operators. Maikel Rollman of the NHCTU stated that the takedown "marks the beginning of further action against SocGholish," suggesting that additional measures may be taken to dismantle the remaining infrastructure. Security researchers will likely monitor the botnet’s activity closely to assess whether the group attempts to rebuild or shift to alternative distribution methods.

Operation Endgame, the broader initiative under which this action was conducted, has previously targeted other major malware operations, including Rhadamanthys, VenomRAT, and Elysium. The operation’s focus on disrupting infection chains and botnet infrastructure underscores a strategic shift in law enforcement’s approach to combating cybercrime, prioritizing the dismantling of distribution networks over individual arrests.