---
id: 7000
title: "Soco404: Multiplatform Cryptomining Campaign Uses Fake Error Pages to Hide Payload"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/soco404-multiplatform-cryptomining-campaign-uses-fake-error-pages-to-hide-payload"
published_at: "2025-07-23T12:00:00Z"
tags: ["cloud-security", "malware", "postgresql", "threat-research", "cryptomining", "soco404"]
phying_url: "https://phying.com/item/7000"
lang: en
---

# Soco404: Multiplatform Cryptomining Campaign Uses Fake Error Pages to Hide Payload

## Summary

Wiz tracks Soco404, a cryptomining campaign abusing PostgreSQL misconfigurations: it hits Linux and Windows, masquerades as system processes, hiding payloads in fake 404 pages on Google Sites.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2025-07-23T12:00:00Z
- **Original:** https://www.wiz.io/blog/soco404-multiplatform-cryptomining-campaign-uses-fake-error-pages-to-hide-payload
- **Phying News:** https://phying.com/item/7000