Fakeupdates

FakeUpdates, a malicious software (malware), has become increasingly prevalent in recent years. It infiltrates systems through suspicious downloads, emails, or websites, often unbeknownst to the user, and can disrupt operations, steal personal information, or hold data hostage for ransom. In 2022, an investigation by Sucuri and Avast observed compromised websites delivering the FakeUpdates downloader (also known as SocGholish) to unsuspecting visitors. This JavaScript-based loader primarily targets Microsoft Windows-based environments and has been used to deliver the AsyncRAT and the legitimate open-source project BOINC. The malware's impact has been significant. As of last month, it was reported that FakeUpdates affected 3% of organizations worldwide, making it one of the top three most prevalent malwares, following Qbot and Formbook. However, at certain points, its impact rose to as high as 8%, surpassing other malware families such as Androxgh0st and Phorpiex. The education sector has been particularly hard-hit, reflecting the broad reach and destructive potential of this malware. Moreover, FakeUpdates has been implicated in complex cyberattacks. Microsoft reported instances where RansomHub was deployed in post-compromise activity by threat actors tracked as Manatee Tempest, who gained initial access via Mustard Tempest using FakeUpdates/SocGholish infections. Similarly, Huntress researchers observed the use of the JavaScript downloader malware SocGholish (aka FakeUpdates) to deliver the remote access trojan AsyncRAT and the legitimate open-source project BOINC. These incidents underscore the sophisticated tactics employed by cybercriminals and the critical need for robust cybersecurity measures.