A practical walkthrough of how Huntress analysts investigate and respond to SocGholish malware infections. The process covers identifying suspicious JavaScript files (Update.js) triggered via browser activity, extracting Chrome browser history using SQLite3, tracing the malicious download back to a compromised WordPress site, and de-obfuscating the multi-stage payload to uncover over 100 potentially compromised domains. Tools like URLScan.io and Kahu Security's URL Revealer are highlighted as useful aids in the investigation.
