https://browsertotal.com/assets/AHg2cFJ4.js

1import{r as e,j as s}from"./jDfCxJ4A.js";import{d as t,E as a,T as i,S as l,a as r,b as c,m as n,u as o}from"./BHtydWM2.js";import{w as h}from"./CDyJKlnm.js";import"./DsaMfc1G.js";import"./ByuAo3pw.js";const d=h(()=>{const[h,d]=e.useState(!1);e.useEffect(()=>{t(a.TAB_VIEWED,{tab_name:"SocGholish Demo",page_type:"security_demo"})},[]);const m=()=>{d(!0),t(a.FEATURE_USED,{feature:"socgholish_simulate_attack_clicked"})},x=()=>{d(!1),t(a.FEATURE_USED,{feature:"socgholish_simulation_cancelled",user_action:"cancelled"})},p=[{label:"RCE Risk",value:"Critical",variant:"danger",icon:s.jsx("svg",{className:"w-4 h-4",fill:"none",viewBox:"0 0 24 24",stroke:"currentColor",children:s.jsx("path",{strokeLinecap:"round",strokeLinejoin:"round",strokeWidth:1.5,d:"M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"})})},{label:"Credential Theft",value:"High",variant:"danger",icon:s.jsx("svg",{className:"w-4 h-4",fill:"none",viewBox:"0 0 24 24",stroke:"currentColor",children:s.jsx("path",{strokeLinecap:"round",strokeLinejoin:"round",strokeWidth:1.5,d:"M15 7a2 2 0 012 2m4 0a6 6 0 01-7.743 5.743L11 17H9v2H7v2H4a1 1 0 01-1-1v-2.586a1 1 0 01.293-.707l5.964-5.964A6 6 0 1121 9z"})})},{label:"Persistence",value:"Active",variant:"warning",icon:s.jsx("svg",{className:"w-4 h-4",fill:"none",viewBox:"0 0 24 24",stroke:"currentColor",children:s.jsx("path",{strokeLinecap:"round",strokeLinejoin:"round",strokeWidth:1.5,d:"M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z"})})},{label:"Detection",value:"Evasive",variant:"warning",icon:s.jsx("svg",{className:"w-4 h-4",fill:"none",viewBox:"0 0 24 24",stroke:"currentColor",children:s.jsx("path",{strokeLinecap:"round",strokeLinejoin:"round",strokeWidth:1.5,d:"M3.055 11H5a2 2 0 012 2v1a2 2 0 002 2 2 2 0 012 2v2.945M8 3.935V5.5A2.5 2.5 0 0010.5 8h.5a2 2 0 012 2 2 2 0 104 0 2 2 0 012-2h1.064M15 20.488V18a2 2 0 012-2h3.064M21 12a9 9 0 11-18 0 9 9 0 0118 0z"})})}];return s.jsxs(i,{variant:"default",animate:!0,children:[s.jsx(l,{title:"SocGholish Attack Simulation",description:"Explore how SocGholish compromises legitimate websites to inject malicious JavaScript code",canonical:"/demos/socgholish"}),s.jsx(r,{variant:"elevated",className:"p-6 mb-6",children:s.jsxs("div",{className:"flex flex-col lg:flex-row lg:items-center justify-between",children:[s.jsxs("div",{className:"mb-4 lg:mb-0",children:[s.jsxs("h1",{className:"text-2xl font-light text-seraphic-light tracking-wide flex items-center gap-3 mb-2",children:[s.jsx("svg",{className:"w-8 h-8 text-seraphic-teal",fill:"none",viewBox:"0 0 24 24",stroke:"currentColor",children:s.jsx("path",{strokeLinecap:"round",strokeLinejoin:"round",strokeWidth:1.5,d:"M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-9.618 5.04L12 21.044l9.618-13.06a11.955 11.955 0 01-9.618-5.04z"})}),"SocGholish (FakeUpdates) Attack Simulation"]}),s.jsx("p",{className:"text-seraphic-light/60 text-sm",children:"Explore how FakeUpdates masquerade as legitimate software updates to infiltrate systems"})]}),s.jsx("div",{children:s.jsx(c,{onClick:m,variant:"primary",size:"md",icon:s.jsx("svg",{className:"w-5 h-5",fill:"none",viewBox:"0 0 24 24",stroke:"currentColor",children:s.jsx("path",{strokeLinecap:"round",strokeLinejoin:"round",strokeWidth:2,d:"M13 10V3L4 14h7v7l9-11h-7z"})}),children:"Simulate Attack"})})]})}),s.jsxs("div",{className:"space-y-6 pb-12",children:[s.jsxs("div",{className:"grid grid-cols-1 lg:grid-cols-3 gap-6",children:[s.jsx("div",{className:"lg:col-span-2",children:s.jsxs(r,{variant:"elevated",className:"p-6 h-full",children:[s.jsxs("h2",{className:"text-xl font-light text-seraphic-light tracking-wide flex items-center mb-4",children:[s.jsx("div",{className:"w-1.5 h-1.5 bg-seraphic-teal rounded-full mr-2"}),"What is SocGholish?"]}),s.jsxs("div",{className:"space-y-4 text-sm text-seraphic-light/80",children:[s.jsx("p",{children:"SocGholish is a malware family that leverages drive-by-downloads masquerading as software updates for initial access. Active since at least April 2018, SocGholish has been linked to the suspected Russian cybercrime group Evil Corp."}),s.jsxs("div",{children:[s.jsx("h3",{className:"text-seraphic-teal font-medium mb-2",children:"Key Characteristics"}),s.jsxs("ul",{className:"space-y-1 ml-4",children:[s.jsxs("li",{className:"flex items-start",children:[s.jsx("span",{className:"text-seraphic-teal/60 mr-2",children:"•"}),s.jsxs("span",{children:[s.jsx("strong",{className:"text-seraphic-light",children:"Infection Method:"})," Compromises legitimate websites to present fake update notifications"]})]}),s.jsxs("li",{className:"flex items-start",children:[s.jsx("span",{className:"text-seraphic-teal/60 mr-2",children:"•"}),s.jsxs("span",{children:[s.jsx("strong",{className:"text-seraphic-light",children:"Targeting:"})," Affects a wide variety of industry verticals with consistent background activity"]})]}),s.jsxs("li",{className:"flex items-start",children:[s.jsx("span",{className:"text-seraphic-teal/60 mr-2",children:"•"}),s.jsxs("span",{children:[s.jsx("strong",{className:"text-seraphic-light",children:"Lures:"})," Primarily browser updates, but also Flash, Java, video players"]})]}),s.jsxs("li",{className:"flex items-start",children:[s.jsx("span",{className:"text-seraphic-teal/60 mr-2",children:"•"}),s.jsxs("span",{children:[s.jsx("strong",{className:"text-seraphic-light",children:"Payload Delivery:"})," Direct JavaScript delivery without ZIP wrapping (80%+ cases since late 2022)"]})]})]})]}),s.jsxs("div",{children:[s.jsx("h3",{className:"text-seraphic-teal font-medium mb-2",children:"Attack Flow"}),s.jsxs("ol",{className:"space-y-1 ml-4 list-decimal list-inside",children:[s.jsx("li",{children:"User visits a compromised website hosting the SocGholish framework"}),s.jsx("li",{children:"JavaScript identifies browser and displays convincing update notification"}),s.jsx("li",{children:'User downloads and runs the "update" - malicious JavaScript executes'}),s.jsx("li",{children:"Script performs reconnaissance for security tools to avoid"}),s.jsx("li",{children:"If conditions are met, additional malware is downloaded"}),s.jsx("li",{children:"Can lead to credential theft, remote access, or ransomware deployment"})]})]})]})]})}),s.jsxs("div",{className:"space-y-6",children:[s.jsxs(r,{variant:"default",className:"p-5",children:[s.jsxs("h2",{className:"text-lg font-light text-seraphic-light tracking-wide flex items-center mb-4",children:[s.jsx("div",{className:"w-1.5 h-1.5 bg-red-500 rounded-full mr-2"}),"Attack Impact"]}),s.jsxs("ul",{className:"space-y-2 text-sm",children:[s.jsxs("li",{className:"flex items-start text-seraphic-light/80",children:[s.jsx("span",{className:"text-red-500/60 mr-2 mt-0.5",children:"•"}),s.jsx("span",{children:"Remote code execution on victim machines"})]}),s.jsxs("li",{className:"flex items-start text-seraphic-light/80",children:[s.jsx("span",{className:"text-red-500/60 mr-2 mt-0.5",children:"•"}),s.jsx("span",{children:"Credential theft from browsers and applications"})]}),s.jsxs("li",{className:"flex items-start text-seraphic-light/80",children:[s.jsx("span",{className:"text-red-500/60 mr-2 mt-0.5",children:"•"}),s.jsx("span",{children:"Deployment of additional malware or ransomware"})]}),s.jsxs("li",{className:"flex items-start text-seraphic-light/80",children:[s.jsx("span",{className:"text-red-500/60 mr-2 mt-0.5",children:"•"}),s.jsx("span",{children:"Persistent access to compromised networks"})]}),s.jsxs("li",{className:"flex items-start text-seraphic-light/80",children:[s.jsx("span",{className:"text-red-500/60 mr-2 mt-0.5",children:"•"}),s.jsx("span",{children:"Data exfiltration from infected systems"})]})]})]}),s.jsxs(r,{variant:"default",className:"p-5",children:[s.jsxs("h2",{className:"text-lg font-light text-seraphic-light tracking-wide flex items-center mb-4",children:[s.jsx("div",{className:"w-1.5 h-1.5 bg-green-500 rounded-full mr-2"}),"Mitigation Strategies"]}),s.jsxs("ul",{className:"space-y-2 text-sm",children:[s.jsxs("li",{className:"flex items-start text-seraphic-light/80",children:[s.jsx("span",{className:"text-green-500/60 mr-2 mt-0.5",children:"•"}),s.jsx("span",{children:"Keep software updated through official channels"})]}),s.jsxs("li",{className:"flex items-start text-seraphic-light/80",children:[s.jsx("span",{className:"text-green-500/60 mr-2 mt-0.5",children:"•"}),s.jsx("span",{children:"Enable automatic updates for browsers and plugins"})]}),s.jsxs("li",{className:"flex items-start text-seraphic-light/80",children:[s.jsx("span",{className:"text-green-500/60 mr-2 mt-0.5",children:"•"}),s.jsx("span",{children:"Use security software with behavioral detection"})]}),s.jsxs("li",{className:"flex items-start text-seraphic-light/80",children:[s.jsx("span",{className:"text-green-500/60 mr-2 mt-0.5",children:"•"}),s.jsx("span",{children:"Implement network security monitoring"})]}),s.jsxs("li",{className:"flex items-start text-seraphic-light/80",children:[s.jsx("span",{className:"text-green-500/60 mr-2 mt-0.5",children:"•"}),s.jsx("span",{children:"Train users to only download from official sources"})]})]})]})]})]}),s.jsxs("div",{children:[s.jsxs("h3",{className:"text-seraphic-light font-light tracking-wide flex items-center mb-4",children:[s.jsx("svg",{className:"w-5 h-5 mr-2 text-seraphic-teal",fill:"none",viewBox:"0 0 24 24",stroke:"currentColor",children:s.jsx("path",{strokeLinecap:"round",strokeLinejoin:"round",strokeWidth:1.5,d:"M9 19v-6a2 2 0 00-2-2H5a2 2 0 00-2 2v6a2 2 0 002 2h2a2 2 0 002-2zm0 0V9a2 2 0 012-2h2a2 2 0 012 2v10m-6 0a2 2 0 002 2h2a2 2 0 002-2m0 0V5a2 2 0 012-2h2a2 2 0 012 2v14a2 2 0 01-2 2h-2a2 2 0 01-2-2z"})}),"Attack Characteristics"]}),s.jsx(n,{items:p,columns:4})]}),s.jsxs(r,{variant:"elevated",className:"p-6",children:[s.jsxs("h2",{className:"text-xl font-light text-seraphic-light tracking-wide flex items-center mb-4",children:[s.jsx("div",{className:"w-1.5 h-1.5 bg-seraphic-teal rounded-full mr-2"}),"Technical Details"]}

1),s.jsxs("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-6",children:[s.jsxs("div",{children:[s.jsx("h3",{className:"text-lg font-light text-seraphic-teal mb-3",children:"Initial Access Vector"}),s.jsx("p",{className:"text-sm text-seraphic-light/80 mb-4",children:"SocGholish typically begins with a compromised legitimate website. Attackers inject obfuscated JavaScript code into the website that checks the victim's browser information. When a user visits the compromised site, the injected code identifies their browser and presents a fake update notification matching their browser type."}),s.jsx("p",{className:"text-sm text-seraphic-light/80",children:"The fake update notification is visually similar to authentic update notices, often using correct logos, styling, and messaging to appear legitimate. If the user clicks to download the update, they receive a JavaScript file that may be disguised with a misleading icon."})]}),s.jsxs("div",{children:[s.jsx("h3",{className:"text-lg font-light text-seraphic-teal mb-3",children:"Payload Execution"}),s.jsx("p",{className:"text-sm text-seraphic-light/80 mb-4",children:"Once executed, the JavaScript payload performs system reconnaissance to gather information about the host. It checks for security software, virtual machines, or analysis tools that could detect its malicious activity. If it detects a security product or analysis environment, it may terminate to avoid detection."}),s.jsx("p",{className:"text-sm text-seraphic-light/80 mb-2",children:"If the checks pass, the JavaScript establishes persistence and downloads additional payloads:"}),s.jsxs("ul",{className:"list-none space-y-1 text-sm text-seraphic-light/80 ml-4",children:[s.jsxs("li",{className:"flex items-start",children:[s.jsx("span",{className:"text-seraphic-teal/60 mr-2",children:"•"}),s.jsx("span",{children:"Information stealers for credential theft"})]}),s.jsxs("li",{className:"flex items-start",children:[s.jsx("span",{className:"text-seraphic-teal/60 mr-2",children:"•"}),s.jsx("span",{children:"Remote access trojans (RATs) for persistent access"})]}),s.jsxs("li",{className:"flex items-start",children:[s.jsx("span",{className:"text-seraphic-teal/60 mr-2",children:"•"}),s.jsx("span",{children:"Cobalt Strike beacons for command and control"})]}),s.jsxs("li",{className:"flex items-start",children:[s.jsx("span",{className:"text-seraphic-teal/60 mr-2",children:"•"}),s.jsx("span",{children:"Additional loaders for further malware deployment"})]})]})]})]})]}),s.jsxs(r,{variant:"default",className:"p-6",children:[s.jsxs("h2",{className:"text-lg font-light text-seraphic-light tracking-wide flex items-center mb-4",children:[s.jsx("div",{className:"w-1.5 h-1.5 bg-seraphic-teal rounded-full mr-2"}),"Activity Patterns"]}),s.jsx("p",{className:"text-sm text-seraphic-light/80",children:"In 2024, SocGholish activity spiked in March, with a second sustained wave from July through September. This coincided with changes to lures used by both SocGholish and the similar fake update threat Scarlet Goldfinch. For the rest of the year, SocGholish maintained a relatively stable background volume, typically affecting about 0.5 percent of monitored environments each month."})]}),s.jsx(r,{variant:"elevated",glow:!0,className:"p-6",children:s.jsxs("div",{className:"flex flex-col md:flex-row items-center justify-between",children:[s.jsxs("div",{className:"flex-1 mb-4 md:mb-0",children:[s.jsxs("h3",{className:"text-xl font-light text-seraphic-light tracking-wide flex items-center mb-3",children:[s.jsx("svg",{className:"w-6 h-6 mr-2 text-seraphic-teal",fill:"none",viewBox:"0 0 24 24",stroke:"currentColor",children:s.jsx("path",{strokeLinecap:"round",strokeLinejoin:"round",strokeWidth:1.5,d:"M13 10V3L4 14h7v7l9-11h-7z"})}),"Simulate Attack"]}),s.jsx("p",{className:"text-sm text-seraphic-light/60",children:"This simulation will demonstrate how SocGholish presents fake update notifications to trick users. The simulation is completely safe and isolated in your browser, with no actual malware being downloaded."})]}),s.jsx(c,{onClick:m,variant:"primary",size:"lg",icon:s.jsx("svg",{className:"w-5 h-5",fill:"none",viewBox:"0 0 24 24",stroke:"currentColor",children:s.jsx("path",{strokeLinecap:"round",strokeLinejoin:"round",strokeWidth:2,d:"M13 10V3L4 14h7v7l9-11h-7z"})}),children:"Simulate SocGholish Attack"})]})}),s.jsxs(r,{variant:"default",className:"p-6",children:[s.jsxs("h2",{className:"text-lg font-light text-seraphic-light tracking-wide flex items-center mb-4",children:[s.jsx("div",{className:"w-1.5 h-1.5 bg-seraphic-teal rounded-full mr-2"}),"Similar Threats"]}),s.jsxs("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-4",children:[s.jsxs("div",{className:"bg-black/20 p-4 border border-seraphic-teal/10 rounded-lg",children:[s.jsx("h3",{className:"text-base font-light text-seraphic-teal mb-2",children:"Scarlet Goldfinch"}),s.jsx("p",{className:"text-sm text-seraphic-light/60",children:"Similar to SocGholish, Scarlet Goldfinch also uses fake update notifications, but employs different infrastru

1cture and attack chains. It has been associated with cryptocurrency miners and information stealers."})]}),s.jsxs("div",{className:"bg-black/20 p-4 border border-seraphic-teal/10 rounded-lg",children:[s.jsx("h3",{className:"text-base font-light text-seraphic-teal mb-2",children:"Magnitude EK"}),s.jsx("p",{className:"text-sm text-seraphic-light/60",children:"The Magnitude Exploit Kit differs by exploiting browser vulnerabilities rather than relying on social engineering, but similarly targets users through compromised websites."})]})]})]})]}),s.jsxs(o,{isOpen:h,onClose:x,title:"Attack Simulation Warning",children:[s.jsx("p",{className:"text-sm text-seraphic-light/80 mb-6",children:"You are about to open a new browser tab that demonstrates a fake update notification typical of SocGholish attacks. This is a safe simulation and does not contain actual malware, but it helps illustrate how these attacks appear to users."}),s.jsxs("div",{className:"flex gap-3 justify-end",children:[s.jsx(c,{onClick:x,variant:"secondary",size:"sm",children:"Cancel"}),s.jsx(c,{onClick:()=>{window.open("/assets/attacks/inthewild/socgholish/1.html","_blank"),d(!1),t(a.ANALYSIS_COMPLETED,{analysis_type:"socgholish_simulation",status:"launched",user_action:"confirmed"})},variant:"danger",size:"sm",children:"Proceed with Simulation"})]})]})]})},{demoName:"SocGholish Demo",demoDescription:"Learn about SocGholish and how to protect your browser.",features:["SocGholish","SocGholish Simulation","SocGholish Detection","SocGholish Prevention"]});export{d as default};