---
title: Newspapers Hit by Malware After Parent Media Org Suffers Attack
description: Threat actor injects malicious code into a benign JavaScript file that in turn is picked up and installed to the websites of affected U.S. news outlets.
---

[SecureWorld News ](https://www.secureworld.io/industry-news)

# [Newspapers Hit by Malware After Parent Media Org Suffers Attack](https://www.secureworld.io/industry-news/newspapers-malware-media-attack)

 Written by [Cam Sivesind](https://www.secureworld.io/industry-news/author/cam-sivesind) | Fri | Nov 4, 2022 | 10:47 AM Z

An undisclosed media organization serving Boston, New York, Chicago, Miami, and other major cities has been hit by cybercriminals who are deploying malware on more than 250 newspaper websites, Proofpoint Threat Research reported on Twitter.

> Proofpoint Threat Research has observed intermittent injections on a media company that serves many major news outlets. This media company serves content via [#Javascript](https://twitter.com/hashtag/Javascript?src=hash&ref_src=twsrc%5Etfw) to its partners. By modifying the codebase of this otherwise benign JS, it is now used to deploy [#SocGholish](https://twitter.com/hashtag/SocGholish?src=hash&ref_src=twsrc%5Etfw).
> 
> — Threat Insight (@threatinsight) [November 2, 2022](https://twitter.com/threatinsight/status/1587865920130752515?ref_src=twsrc%5Etfw)

Proofpoint has identified the bad actor as TA569. The attack vector injects malicious code into a benign JavaScript file that in turn is picked up and installed to the websites of affected news outlets. 

The affected file then installs SocGholish, and anyone who visits the attacked websites will encounter fake browser updates filled with hidden malware payloads.

The media company in question supplies video content and advertising to major news outlets via JavaScript.

For more information on SocGholish, also known as FakeUpdates, and other malware attacks, Proofpoint offered this [threat insight](https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware) in June 2021.

[View full post](https://www.secureworld.io/industry-news/newspapers-malware-media-attack)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Cam Sivesind"
  },
  "dateModified" : "2022-11-04T10:47:00.386Z",
  "datePublished" : "2022-11-04T10:47:00Z",
  "headline" : "Newspapers Hit by Malware After Parent Media Org Suffers Attack",
  "image" : {
    "@type" : "ImageObject",
    "height" : 426,
    "url" : "https://info.secureworld.io/hubfs/Blog%20Images/newspapers_world_business_2651346.jpg",
    "width" : 640
  },
  "mainEntityOfPage" : "https://www.secureworld.io/industry-news/newspapers-malware-media-attack",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/2221756/Logos/SWE/SWE_logo_full-long_forWHITEbackgrounds.jpg",
      "width" : 304.46954
    },
    "name" : "SecureWorld News"
  }
}
```