Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

Operation EndGame Disables SocGholish, Seizes 106 Servers

Part of the SocGholish story · since 19 Jun

Quiet for 19 weekslast report 25 Jun9 articles7 outlets
19 Jun · SecurityWeek first26 Aug18 Sep11 OctNowThis article3rd of 9
  • Fri 19 Jun, 07:29 UTC. SecurityWeek, first report. Global police take down SocGholish malware, protect 15k WP sites.
  • Fri 19 Jun, 10:40 UTC. Infosecurity, its first report on the story. Dutch Police Lead Global Takedown of SocGholish Malware Botnet.
  • Fri 19 Jun, 14:31 UTC. Security Affairs, its first report on the story. Operation EndGame Disables SocGholish, Seizes 106 Servers. This article, 3rd of 9.
  • Fri 19 Jun, 15:40 UTC. The Hacker News, its first report on the story. Operation Endgame dismantles SocGholish, cleans 15k sites.
  • Fri 19 Jun, 16:50 UTC. Malwarebytes, its first report on the story. Operation Endgame Shuts Down SocGholish, Cleans 15k WP Sites.
  • Mon 22 Jun, 07:31 UTC. Malwarebytes. A week in security (June 15 – June 21).
  • Tue 23 Jun, 14:03 UTC. Dark Reading, its first report on the story. Global raid dismantles SocGholish malware used by ransomware.
  • Wed 24 Jun, 19:31 UTC. Security Affairs. Europol seizes StealC, Amadey, SocGholish in Operation Endgame.
  • Thu 25 Jun, 03:31 UTC. SecurityOnline, its first report on the story. Operation Endgame Takes Down SocGholish, Amadey, and StealC Malware.

On June 18, 2026, a coordinated effort by law enforcement from the Netherlands, Canada, the U.S., and Germany successfully disrupted the SocGholish malware distribution network through Operation EndGame. The operation resulted in the takedown of 106 servers and the remediation of 14,971 WordPress sites infected with malware. SocGholish is known for utilizing fake browser update prompts to deliver malware after exploiting vulnerabilities in legitimate websites.

The authorities urged WordPress site owners to update their sites and change credentials, highlighting the significance of ongoing security measures to prevent reinfection. The operation, while impactful, does not eradicate the broader issue of web injects, a technique growing in prevalence across various threat actors.

How the story developed

All 9 articles
Quiet for 19 weekslast report 25 Jun9 articles7 outlets

9 articles from 7 outlets since 19 Jun. Quiet since 25 Jun. This was the 3rd report, 7 hours after the first.

Now19 Jun202122232425261 NovFirst reportSecurityWeek · 19 Jun, 07:29This article3rd of 9 · day 0
  • Fri 19 Jun, 07:29 UTC. SecurityWeek, first report. Global police take down SocGholish malware, protect 15k WP sites.
  • Fri 19 Jun, 10:40 UTC. Infosecurity, its first report on the story. Dutch Police Lead Global Takedown of SocGholish Malware Botnet.
  • Fri 19 Jun, 14:31 UTC. Security Affairs, its first report on the story. Operation EndGame Disables SocGholish, Seizes 106 Servers. This article, 3rd of 9.
  • Fri 19 Jun, 15:40 UTC. The Hacker News, its first report on the story. Operation Endgame dismantles SocGholish, cleans 15k sites.
  • Fri 19 Jun, 16:50 UTC. Malwarebytes, its first report on the story. Operation Endgame Shuts Down SocGholish, Cleans 15k WP Sites.
  • Mon 22 Jun, 07:31 UTC. Malwarebytes. A week in security (June 15 – June 21).
  • Tue 23 Jun, 14:03 UTC. Dark Reading, its first report on the story. Global raid dismantles SocGholish malware used by ransomware.
  • Wed 24 Jun, 19:31 UTC. Security Affairs. Europol seizes StealC, Amadey, SocGholish in Operation Endgame.
  • Thu 25 Jun, 03:31 UTC. SecurityOnline, its first report on the story. Operation Endgame Takes Down SocGholish, Amadey, and StealC Malware.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 9 articles as a list
  1. Fri 19 JunDay 05
    1. Global police take down SocGholish malware, protect 15k WP sites07:29 · SecurityWeek · First report
    2. Dutch Police Lead Global Takedown of SocGholish Malware Botnet10:40 · Infosecurity
    3. Operation EndGame Disables SocGholish, Seizes 106 Servers14:31 · Security Affairs · This article, 3rd of 9
    Show 2 more from 19 Jun
    1. Operation Endgame dismantles SocGholish, cleans 15k sites15:40 · The Hacker News
    2. Operation Endgame Shuts Down SocGholish, Cleans 15k WP Sites16:50 · Malwarebytes

  2. Quiet for 3 days

    Mon 22 JunDay 31
    1. A week in security (June 15 – June 21)07:31 · Malwarebytes · Picked up again
  3. Tue 23 JunDay 41
    1. Global raid dismantles SocGholish malware used by ransomware14:03 · Dark Reading
  4. Wed 24 JunDay 51
    1. Europol seizes StealC, Amadey, SocGholish in Operation Endgame19:31 · Security Affairs
  5. Thu 25 JunDay 61
    1. Operation Endgame Takes Down SocGholish, Amadey, and StealC Malware03:31 · SecurityOnline

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in