Malware
Gholoader
- First Reported
- Jun 18, 2026
- Latest Reported
- Jun 19, 2026
Reported Context (4)
- Orange Cyberdefense said it has observed SocGholish infections delivering loaders like Gholoader (another JavaScript-based loader) and MintsLoader, which, in turn, lead to the deployment of additional payloads like Operation Endgame Takes Down 106 SocGholish Servers and Cleans Nearly 15,000 WordPress Sites
- Orange’s cyber defense unit observed SocGholish delivering loaders like Gholoader and MintsLoader, which eventually led to payloads such as the GhostWeaver PowerShell backdoor, LockBit and RansomHub ransomware, and Authorities Disrupt SocGholish Botnet, Clean Nearly 15,000 WordPress Sites
- [T1059.003 ] Windows Command Shell – The infection chain includes WSH JScript execution and script-based payload delivery on Windows systems (‘The downloaded file is GhoLoader Stage 1 — a WSH JScript’). Operation Endgame Disrupts TA569’s SocGholish Infrastructure, Remediates 14,971 Websites
- #SocGholish Authorities Clean SocGholish From 14,971 WordPress Sites, Take Down 106 Servers
Malware (20)
People (1)
Threat Actors (22)
MITRE ATT&CK (10)
Vendors (1)
Products (6)
Tools (3)
Industries (14)
Countries (11)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.