Global law enforcement agencies have removed malware from nearly 15,000 infected WordPress websites and disabled over 100 servers tied to the SocGholish botnet and the Russian cybercrime group Evil Corp.

This coordinated effort, backed by Europol and Eurojust, formed part of Operation Endgame, a large-scale initiative now focused on disrupting a major infection vector associated with Evil Corp.

Officials from the Netherlands (NHCTU), Canada (RCMP), the United States (FBI), and Germany (BKA) cleared SocGholish infections from 14,971 affected WordPress sites and took 106 servers and domains offline.

Dutch police eliminated the malware and backdoors from the compromised sites while urging owners to update their passwords, activate multi-factor authentication, remove unknown WordPress accounts, and maintain current software versions.

"These measures deny cybercriminals access to compromised systems. This stops additional harm to digital infrastructure used by citizens, companies, and organizations around the world and curbs malware distribution," stated Maikel Rollman of the Netherlands' National High Tech Crime Unit.

"It also lowers the chance that these systems will support attacks on critical infrastructure and vital societal functions. This action signals the start of expanded efforts against SocGholish."

The JavaScript-based SocGholish downloader, also known as FakeUpdates and GhoLoader, has featured in attacks since 2017. It compromises legitimate sites, mainly WordPress platforms, and deceives visitors into installing harmful payloads presented as fake browser updates.

Once installed, the malware establishes a link to the attackers, granting them control over the system. SocGholish has delivered additional strains such as Dridex, Doppelpaymer, Empire, Koadic, Chtonic, and Azorult.

The malware has been connected to Evil Corp, a Russian cybercrime organization active since 2007 and linked to Zeus and Dridex, as well as the WastedLocker, Hades, Macaw Locker, and Phoenix CryptoLocker ransomware campaigns.

"This marks the beginning of further action against SocGholish," Rollman noted in a statement released today.

In November, Operation Endgame also dismantled more than 1,000 servers used by the Rhadamanthys, VenomRAT, and Elysium botnet operations.

Earlier phases of the operation targeted ransomware infrastructure, Smokeloader botnet assets, the AVCheck site, and other significant malware campaigns including DanaBot, IcedID, Pikabot, Trickbot, Smokeloader, Bumblebee, and SystemBC.