Threat Actors Leverage Fake Update Lures to Deliver SocGholish Malware

Cybersecuritynews •Tushar Subhra Dutta • November 27, 2025

Threat actors continue to exploit a dangerous vulnerability in user behavior by deploying fake software updates to deliver the SocGholish malware. This malware delivery framework has evolved significantly since its discovery in 2017, transforming from a simple web-based nuisance into a powerful tool that enables major ransomware operations targeting organizations worldwide. Recent campaigns demonstrate how […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Russian-linked Threat Actors Deploy SocGholish Malware via Fake Browser Updates Cybersecurity researchers at Arctic Wolf Labs have identified a cyberattack campaign utilizing fake browser update notifications to distribute SocGholish malware. This campaign is linked to Russian threat actors and targets unsuspecting users, potentially compromising their systems. 12 sources 31

Threat Actors Leverage Fake Update Lures to Deliver SocGholish Malware

The full story

Extracted Entities

Attack Types (2)

Malware (1)