Hundreds of poisoned WordPress sites are feeding visitors into a fake-browser-update campaign, and the operation is still running a month after international law enforcement took down the malware’s infrastructure.
Kirk, a researcher at -tracking site Derp.ca, tracked 1,509 WordPress sites between April 21 and July 21, 2026, that were rigged to funnel visitors into a SocGholish infection chain. The sites are otherwise legitimate in origin, however hacked, Kirk found.
The trick is that the malicious traffic never looks malicious.
The compromised WordPress site itself hands a visitor’s browser an opaque token, runs it through a three-step eligibility check, and only then serves up the payload. And that’s all from a hostname the visitor already trusts, according to Derp.ca’s analysis.
Proofpoint, whose researchers have tracked SocGholish since 2018, describes the compromised sites as functioning like a reverse proxy. No request to the attacker’s real infrastructure ever shows up in the visitor’s browser network panel, because the WordPress server is the one making that call on the backend.
Visitors who clear the check and who aren’t running an automated scanner, aren’t logged in as a WordPress admin, and don’t have developer tools open, per both Derp.ca and Proofpoint. A target gets served a fake browser-update page. On Windows machines, that update delivers a loader both trackers call GhoLoader, disguised as a file named Google Launcher.js.
“Every malicious request stayed on the compromised origin,” Kirk wrote.
Breaking down ‘same-origin gateways’
A same-origin gateway means standard defenses don’t catch it. A visitor’s browser is talking to the site they meant to visit, over a connection that site already had permission to make. There’s no foreign domain popping up in a network trace to flag.
The malicious logic isn’t in where the traffic goes; it’s in what the compromised WordPress install decides to serve back, based on a token exchange happening entirely on infrastructure the victim already trusted. That’s why Derp.ca’s indicators of compromise focus on request patterns and route names rather than blocklists of external domains.
How visitors get there in the first place
Proofpoint says it sees the entry point mostly through ordinary email: legitimate-looking messages containing links to the compromised WordPress sites, which then redirect into the attack chain. The sites and the links look benign because, for every other visitor, they are.
The 1,509-site cluster Derp.ca tracked overlaps with, but is distinct from, the SocGholish infrastructure that international law enforcement dismantled on June 18. That action, part of Operation Endgame, run by the Netherlands’ NHTCU, the FBI, Canada’s RCMP, and Germany’s BKA with Europol’s support, took down 106 servers and domains and cleaned malware off 14,971 WordPress sites, drawing on a dataset of roughly 1.4 million compromised WordPress credentials collected between May 2023 and May 2026, according to Shadowserver’s report on the operation.
Proofpoint’s own writeup notes the takedown targeted TA569, the group behind SocGholish. It added the takedown “likely won’t significantly impact activities from TA2726, one of the TDS providers that supports TA569.”
Derp.ca’s tracking window runs a month past the takedown date. The traffic-distribution layer that feeds SocGholish its victims wasn’t part of what got dismantled.
Some of the same hacked WordPress hosts in Derp.ca’s dataset picked up a second infection later. ClickFix, a fake-CAPTCHA social-engineering technique, was used to trick visitors into pasting and running malicious commands. Derp.ca calls the earlier SocGholish gateway a useful early-warning sign that ClickFix may follow on the same host, not an interchangeable substitute for it.
Cleanup, per Derp.ca’s and Proofpoint’s guidance, needs to go past deleting the fake update pages. Site owners should check for unrecognized WordPress admin accounts and PHP files outside the plugin directory, rotate all site and hosting credentials, and enable MFA. Since the same leaked-credential pool that got a site compromised once tends to still be circulating, both Derp.ca and Proofpoint note.
