RomCom Uses SocGholish Fake Update Attacks to Deliver Mythic Agent Malware

The RomCom threat group has been observed using the SocGholish JavaScript loader in fake update attacks to deliver Mythic Agent malware. This represents the first documented case of RomCom payload being distributed through SocGholish infrastructure. The attack targeted a U.S.-based civil engineering company, demonstrating the group's continued evolution in delivery mechanisms. Arctic Wolf Labs attributed this activity with medium-to-high confidence, highlighting a significant shift in RomCom's operational tactics.