@defender @jeromesegura @terribleplan Possibly. The #SocGholish TA still first lands a JS that collects info about the victim. Up until July 17th I saw them switching to PS after that JS collection. But I haven't seen them do anything more than collect the info. Looks like this.

(Compromised site)
-->
greedyfines[.]org/GRzk7JSP (Keitaro)
-->
sandwiches.tropipackfood[.]com/I9tOCVj5LWBH+XQ7FehiK1H5dCtHvjhxUqlsdA== (SocGholish TDS)
-->
lmd.plan.gemmadeealexander[.]com/editContent (SocGholish JS C2)

Going direct to the PS hop still works for me. For example just now it does this chain.

hXXp://asfgze[.]fun/f23.svg
-->
hXXp://kedkejehiciellf[.]top/1.php (DGA)
-->
hXXp://kedkejehiciellf[.]top/2.php (DGA)
-->
hXXps://dprn0jmb1nag5t9[.]top:14235 (PowerShell C2)

The #FakeSG TA doesn't do JS or PS. They simply land NetSupport. The chain from a few minutes ago.

(Compromised site)
-->
google-analytiks[.]com/sBY76j (Keitaro)
-->
alexiakombou[.]com/wp-content/uploads/2022/01/downloader(updchr(V104.215.214)silent.url ()
-->
hXXp://185[.]252.179.64@80/Downloads/silentupdater-chr(v105).lnk ()
-->
alexiakombou[.]com/wp-content/uploads/2021/12/EN-localer.hta (HTA)
-->
hxxps://94[.]158.244.41:443 (NetSupport)

I'm wondering if the SocGholish TA is on vacation. They usually rotate parts of the chain at least once a week and I haven't seen a change since July 20th. That and the JS to PS hasn't worked since July 17th, at least not for me.