14,971 WordPress Sites Cleaned in Global SocGholish Takedown

(Pierluigi Paganini – Security Affairs) On June 18, 2026, law enforcement agencies from the Netherlands, Canada, the United States, and Germany, coordinated through Europol, executed a joint action week against SocGholish, one of the most persistent and widely deployed malware distribution networks on the internet. The Operation EndGame took down over 100 servers and domains and removed infections from 14,971 compromised WordPress websites. Proofpoint, which has tracked the group behind SocGholish since 2018, provided intelligence to support the law enforcement actions. “In the past few days, the Netherlands (NHCTU), Canada (RCMP), the United States (FBI) and Germany (BKA), with support from Europol and Eurojust, delivered a major blow to SocGholish’s criminal infrastructure during a joint action week.” reads the press release. “Worldwide, 106 servers and domains were taken down. 14.971 websites have been remediated. In addition, the following actions were carried out: – 14,971 WordPress Sites Cleaned in Global SocGholish Takedown