New SocGholish persistence method

While investigating customer detections in Q1 2024, ReliaQuest researchers identified the fake-update malware variant [“SocGholish” ingressing Python](https://www.reliaquest.com/blog/new-python-socgholish-infection-chain/?utm_source=reddit&utm_medium=social&utm_content=blog)—rather than Blister Loader—to establish persistence with a scheduled task, signaling an evolution in the malware’s behavior.

* SocGholish is using drive-by compromise in this new method to trick users into downloading a malicious JavaScript file. The file then downloads and extracts Python from a trusted domain and creates a scheduled task to run a malicious Python script.
* ReliaQuest believes this tactic will …

blueteamsec capabilities compromise defense domain downloads drive drive-by evasion file javascript malicious obfuscated organizations powershell powershell scripts python python script reliaquest run scheduled task script scripts socgholish tactic task