SLED Warns of Hacked 'HereCity' News Websites in South Carolina

Got story updates? Submit your updates here. ›

The South Carolina State Law Enforcement Division (SLED) is warning that numerous local news websites across the state using the 'HereCity' platform have been hacked and are serving malicious JavaScript. The script prompts users to execute a command that downloads and runs a PowerShell payload, compromising their machines.

Why it matters

The HereCity network of local news sites is widely used across South Carolina, often ranking highly in Google search results for community news. The hacking campaign puts many residents at risk of having their devices compromised if they visit the infected sites.

The details

The malicious JavaScript is being served from the domains ewar4pres.com and road-to-hell.top, which should be treated as malicious infrastructure. When a user visits one of the compromised sites, the script displays a fake browser error or CAPTCHA prompt instructing them to copy and paste a command into their Windows Run dialog, which then downloads and executes a PowerShell payload silently in the background.

• The hacking campaign was first detected and reported by SLED on March 11, 2026.

What’s next

SLED is advising organizations to block all known compromised South Carolina-based HereCity sites and associated malicious infrastructure at the DNS and perimeter firewall levels, search logs for connections to the malicious domains, and look for suspicious PowerShell activity that may indicate the payload was executed.