For the first time, a RomCom payload has been observed being distributed via SocGholish

In November 2025, Arctic Wolf Labs reported the first instance of RomCom malware being distributed via the SocGholish framework, targeting a U.S. civil engineering firm. The RomCom group, linked to Russian interests, has been active since mid-2022 and primarily targets organizations associated with Ukraine. The attack involved the delivery of the Mythic Agent payload through a fake update prompt, exploiting SocGholish's capabilities to trick users into downloading malware.

The report highlights the evolution of SocGholish from a minor threat to a significant vector for ransomware groups, utilizing compromised websites and malicious JavaScript to execute attacks. The infection chain was rapid, with payload delivery occurring within 30 minutes after user interaction with a fake update prompt.