Authorities have dismantled part of a malicious network called SocGholish, also known as FakeUpdates, which had been infecting websites—especially WordPress sites—for years to trick visitors into downloading malware.

Police in the Netherlands, Canada, the United States, and Germany, with support from Europol and private companies, managed to take down 106 servers and control domains used by SocGholish. They also cleaned nearly 15,000 infected WordPress websites.

This attack operated through legitimate websites, using known vulnerabilities or stolen credentials, and inserted malicious code. When users saw the update announcement, they installed the malware, granting access to their data.

This case is particularly important because SocGholish was a virus with a backdoor. Once on your system, it was capable of accessing any file, installing spyware, and hijacking the system. 

It primarily affects owners of compromised WordPress websites and users who visited those pages. Furthermore, they confirmed that SocGholish infiltrated high-traffic websites, so the potential reach is significant.

The authorities' recommendations are clear: change passwords, enable MFA, delete suspicious accounts, and keep WordPress updated.