An employee at a small construction company clicked what looked like a browser update prompt. It wasn't. It was a fake Chrome update page — a "drive-by download" designed to look routine enough that nobody would think twice about it.
The client's existing endpoint protection caught the file-execution event, automatically remediated the file, and rolled back the changes. By every normal measure, the incident was closed before it started.
The part that didn't sit right
Something about the alert didn't match the way real "routine" incidents usually look. Rather than close the ticket, we pulled the flagged file, ran it in an isolated sandbox, and opened it in a text editor. What we found was heavy encoding and obfuscation — the kind of complexity that doesn't belong in a harmless update file.
That was enough to treat this as an active investigation, not a closed ticket.
Layered detection caught what one tool alone didn't
This client's environment was in the middle of being onboarded onto our SIEM platform. Almost immediately after deployment, it fired an alert on a suspicious PowerShell script — the same heavily encoded pattern we'd just found by hand.
We escalated directly to our MXDR (Managed eXtended Detection & Response) partner team. Within five minutes, they confirmed the script was malicious and walked us through full remediation before it could move further into the environment.
What it actually was
After remediation, the MXDR team reverse-engineered the payload and attributed the tactics, techniques, and procedures to SocGholish — a well-documented malware family known for exactly this move: a fake browser-update page used as the initial foothold. SocGholish intrusions are a known precursor to ransomware deployment, with demands in cases like this typically running $100,000–$200,000.
In other words: this wasn't a nuisance file. It was the opening step of a ransomware attack.
The outcome
- No ransomware deployment
- No data loss
- No downtime
- Full continuity of business operations
The client walked away with a real-world example of why layered security — endpoint protection, SIEM, and 24/7 MXDR overwatch — matters even for a business with no reason to think it'd ever be a target.
— Jack West, West Computers
Why this matters for small businesses
Attackers don't check company size before choosing a target — automated drive-by campaigns hit whoever clicks. A single layer of protection, even a good one, can miss what a determined or well-disguised threat is doing under the hood. The difference here wasn't luck; it was having a second and third layer of detection in place, plus a team willing to double-check a "resolved" alert instead of taking it at face value.