SocGholish Fake Browser Update: What to Do If Someone Clicked It

Someone clicked the fake Chrome update. What do I do right now?

Get that computer off the network, leave it powered on, and call whoever runs your IT. Don’t keep using it, don’t wipe it, and don’t try to clean it up yourself. The file is a door, not the whole attack. The goal in the first hour is to shut the door before someone walks through it.

In order:

1. Disconnect it. Unplug the network cable and turn off Wi-Fi. If you can’t do either, shut it down. CISA’s #StopRansomware Guide says to isolate affected systems right away and to power down only if you can’t disconnect them, because a running machine holds evidence.
2. Don’t wipe it or run random cleaners. IT needs to see what ran and when. A reinstall before anyone looks destroys the trail that shows whether the attacker moved to other machines.
3. Call IT now, not tomorrow. Tell them the website, roughly what time it happened, and the file name if you saw it.
4. Change passwords from a different device. Start with email, your agency management system, carrier portals, and banking. Assume anything saved in that browser is exposed. Turn on MFA anywhere it isn’t on yet.
5. Write it down. Who clicked, which site, what time, what they saw. Your incident response plan should say who gets this list.

If you run an insurance agency, check your notice duties too. Tennessee’s version of the NAIC model law has a three-business-day clock to notify the commissioner once you determine a qualifying cybersecurity event happened. Your IT provider’s findings are what tell you whether you’ve hit that bar.

What is SocGholish?

SocGholish is a JavaScript downloader spread through legitimate websites that criminals have hacked. The Center for Internet Security (MS-ISAC) describes it as using “fake software updates, specifically browser updates, to trick users into downloading the malware.” Security firms also call it FakeUpdates. Proofpoint tracks the group behind it as TA569. Microsoft calls it Mustard Tempest, which used to be DEV-0206.

The site you were on wasn’t fake. That’s what makes this one work. Europol’s June 2026 announcement says the attackers mostly hack WordPress sites, and the sites it cleaned up included “restaurants, auto repair shops, and other everyday services.” Your staff could be looking up a client’s business or a local vendor when the page goes gray and says the browser needs an update.

The download is a script, not a program. In 2022 Microsoft described the lure delivering “a ZIP file” that “contains a JavaScript file (.js), which in most environments runs when double-clicked.” Proofpoint says the file type varies and “includes .js, .zip, or .iso files among others.”

How does a fake browser update turn into ransomware?

The person who infects your PC usually isn’t the one who encrypts it. Proofpoint calls TA569 an initial access broker, an actor who “infiltrates major targets and then sells access to other groups to deliver follow-on payloads such as ransomware.” Europol says the same thing in plainer words: once the fake update runs, “the malware opens a connection to the hackers,” and “even more dangerous software can then be installed.”

The ransomware links are documented:

• Microsoft wrote in 2022 that FakeUpdates infections led to activity from DEV-0243, a ransomware group that “overlaps with actions tracked as EvilCorp,” which had deployed LockBit.
• Microsoft’s profile of Manatee Tempest, its name for Evil Corp, says the group used WastedLocker ransomware in its early partnership with Mustard Tempest.
• Proofpoint’s June 2026 writeup ties TA569’s injects to WastedLocker, LockBit, and RansomHub.

One more reason not to go it alone: the U.S. Treasury sanctioned Evil Corp on December 5, 2019. If this ever reaches a ransom note, that call involves your lawyer and your cyber insurer, not the office.

Wasn't SocGholish taken down?

It was disrupted, not erased. On June 24, 2026, Europol announced an Operation Endgame action in which 14,971 infected websites were remediated and the SocGholish botnet was disabled “by taking over domain names and taking servers offline.” Proofpoint’s account names the Netherlands, Canada, the United States, and Germany as the countries that acted, and puts it at over 100 servers and domains taken down.

The trick is still around. The same Proofpoint post counts “nearly a dozen different threat actor clusters” running web-inject campaigns and expects others to fill the gap. Treat any “your browser is out of date” page as hostile, whatever name is behind it this month. The same goes for fake CAPTCHA pages that ask you to paste a command, which we cover in our ClickFix guide, and for malvertising that pushes fake software downloads.

How can staff tell a fake browser update from a real one?

A real browser update never comes from a web page. Chrome and Edge update themselves in the background. Google says Chrome updates usually “happen in the background when you close and reopen” the browser. Microsoft says Edge “automatically updates when you restart your browser.”

Teach one rule: if a website tells you to update your browser, close the tab. To check for real, go to the browser’s own menu. In Chrome that’s Help, then About Google Chrome. In Edge it’s Help and feedback, then About Microsoft Edge. Europol’s advice is the same: “A genuine update always comes from the official source.” A file ending in .js, or a .zip with a .js inside, is never a browser update.

How do we stop this from running next time?

Training helps, but it shouldn’t be the only thing standing between a click and a ransomware crew. Three technical controls cover most of it:

• Turn off Windows Script Host where nobody needs it. Microsoft documents a registry setting that disables WSH for one user or for every user on a machine. After that, a double-clicked .js file gets an error instead of running. Have IT test it first, because some line-of-business software still uses scripts. Then push it to every machine at once.
• Turn on the ASR rules for scripts. Microsoft Defender has attack surface reduction rules called Block JavaScript or VBScript from launching downloaded executable content and Block execution of potentially obfuscated scripts. Microsoft says malware written in JavaScript or VBScript “often acts as a downloader to fetch and launch other malware.”
• Run EDR and have someone watching it. EDR is what catches the follow-on activity if a script gets through. Antivirus alone isn’t the same thing, which we explain in EDR vs antivirus. Microsoft notes that some access-broker ads specifically mention a system “isn’t managed by an antivirus or endpoint detection and response (EDR) product.” Unwatched machines sell for more.

Behind all three, keep backups the attacker can’t reach. The 3-2-1 backup rule with an offline copy is what turns a ransomware event into a restore instead of a negotiation. MFA on email and carrier portals limits what stolen passwords are worth.

Key takeaways

What this looks like when we do it

On our managed IT and security plan, every machine gets the same baseline: EDR, 24/7 monitoring, patching, and email filtering. When EDR flags a machine, it can cut that machine off from the network remotely, which gets you step one without anyone hunting for a cable. Critical issues get a response in under 15 minutes. Then we work the incident: what ran, whether it reached other machines, which passwords need to change, and what you need to document.

We push settings like the script controls above across a fleet through our RMM tooling, so they land on every machine, not just the ones someone remembered. For insurance agencies, that work also produces the records the NAIC model law and carrier questionnaires ask for: what happened, when you found it, and what you did about it.

If someone in your office clicked a fake update and you’re not sure what happened next, see what our managed security covers, or book a call below and we’ll walk through it with you.