Malware
FAKEUPDATES
aka FakeUpdate · GhoLoader · SocGholish
FAKEUPDATES is a downloader written in JavaScript that communicates via HTTP.
FAKEUPDATES, also known as FakeUpdate, GhoLoader, SocGholish, is a JavaScript malware family operated by GOLD PRELUDE.
Background
FAKEUPDATES is a JavaScript downloader that uses HTTP for communication. It can retrieve both executable and JavaScript payloads, saving them to disk before execution. Infections have served as a foothold for follow-on malware such as CHTHONIC, DRIDEX, EMPIRE, KOADIC, DOPPELPAYMER, and AZORULT.
The financially driven group UNC1543 has made extensive use of FAKEUPDATES.
Source: Malpedia (Fraunhofer FKIE).