Loading story…
Attackers are actively exploiting CVE-2026-26980, a critical SQL injection flaw in Ghost CMS, to compromise more than 700 unpatched websites and turn them into malware delivery platforms. The vulnerability, patched in Ghost 6.19.1, allows exposure of the Admin API key through the Content API, giving attackers the ability to take over sites and alter published content. Researchers said the campaign has affected organizations across higher education, media, fintech, AI, SaaS, blockchain, and security research, with evidence suggesting the flaw was weaponized almost immediately after disclosure and that at least two separate threat groups have been abusing it, sometimes targeting the same sites.
The intrusions rely on injected malicious JavaScript that redirects visitors into ClickFix social-engineering flows, including fake CAPTCHA or human-verification prompts that instruct users to paste a Base64-encoded command into the Windows Run dialog. The staged infection chain has delivered ZIP, batch, PowerShell, DLL, JavaScript, and Windows executable payloads, with infrastructure including clo4shara[.]xyz/11z77u3.php and web-telegram[.]ug, and cloaking used to evade detection. Defenders are being urged to upgrade Ghost immediately, rotate API credentials, inspect logs for suspicious Admin API activity, remove injected scripts from stored content, and notify visitors who may have been exposed.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
Researchers revealed that the injected code functioned as a two-stage loader, retrieving payloads from clo4shara[.]xyz/11z77u3.php and using Adspect cloaking to selectively serve fake CAPTCHA lures. Victims were tricked into executing Base64-encoded commands that led to multi-stage malware delivery and, in some cases, persistence via a modified Grape desktop client communicating with web-telegram[.]ug.
QiAnXin assessed that at least two separate threat groups were conducting the website-poisoning operations, sometimes competing over the same compromised sites. The campaign used dynamic infrastructure changes, flexible payload delivery, and cloaking to evade detection.
Qianxin XLab reported that by May 10, 2026, the Ghost CMS exploitation campaign had already poisoned 156 confirmed domains. The count showed the operation scaling rapidly only days after active exploitation was first detected on May 7.
Threat actors hijacked more than 700 unpatched Ghost CMS sites across sectors including universities, media, fintech, SaaS, AI, blockchain, and security research. They injected malicious JavaScript into trusted pages to turn them into delivery points for ClickFix-style social engineering.
QiAnXin observed active exploitation of CVE-2026-26980 beginning by early May 2026, with one report specifying activity since at least May 7. Attackers used automated scanning and key extraction to identify and compromise unpatched Ghost CMS instances.
Malicious code tied to the campaign carried a compilation date matching the day Ghost announced the fix, indicating attackers quickly developed exploit tooling after public disclosure. This suggests near-immediate weaponization of the patched vulnerability.
Ghost fixed the critical SQL injection vulnerability CVE-2026-26980 in February 2026 with the release of version 6.19.1. The flaw in the Content API could expose the Admin API key and enable site takeover.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
6 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcethecyberexpress.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors covertly compromised **250+ legitimate WordPress websites**—including small businesses, regional media outlets, and at least one **U.S. Senate candidate** campaign site—and used them as distribution points for an **infostealer** operation. Rapid7 reported that attackers injected malicious code into the compromised sites to display a convincing **fake Cloudflare CAPTCHA** page that instructs visitors to **copy and execute a command** on their own machines, leveraging the **ClickFix** social-engineering technique to initiate malware delivery. Once executed, the malicious command leads to installation of credential-stealing malware capable of exfiltrating **browser-stored credentials**, **authentication cookies**, and **cryptocurrency wallet data**, with stolen “logs” potentially monetized on cybercrime forums. Reporting indicates the campaign has been active since **December** and shows signs of **high automation** across unrelated WordPress instances; Rapid7 also noted attacker-controlled domains used in the operation were registered around **July–August**, and the firm said it **notified U.S. authorities** to support investigation and remediation.
Jul 1, 2026
Threat actors used compromised legitimate websites—especially **WordPress** sites—to display fake CAPTCHA or browser-verification prompts that trick visitors into manually running malicious commands, resulting in information-stealer infections. Kroll reported that the **CLEARFAKE** campaign evolved from fake browser updates to a **ClickFix-style** technique in which victims copy, paste, and execute malicious PowerShell, while CyberCX linked a similar **DarkEngine** operation to at least **2,353** likely compromised WordPress sites after attackers allegedly stole administrator credentials through SEO-poisoned phishing pages and fake **WP Engine** logins. The campaigns relied on injected JavaScript and increasingly evasive delivery methods, including **EtherHiding**, which retrieves attacker-controlled code from the **BNB Smart Chain** through blockchain-related endpoints. Observed payloads decoded obfuscated content, downloaded follow-on malware, and performed discovery and credential theft, while NJCCIC said related ClickFix activity installed **MonsterV2** and could also deliver **StealC** or **Rhadamanthys**. Stolen data included browser information, account credentials, cryptocurrency wallets, and other sensitive personal information, showing how fake verification prompts on trusted sites are being used as an effective malware-delivery channel.
Aug 15, 2026
Threat researchers reported continued evolution and operationalization of **ClickFix**-style social engineering, where victims are tricked into manually executing attacker-supplied commands via the Windows Run dialog. Huntress described a new variant dubbed **CrashFix**, attributed to **KongTuke**, which uses a **malicious browser extension** to display a fake “browser stopped abnormally” security warning and a bogus “scan” flow; the extension silently places a **PowerShell** command on the clipboard, disguised as a legitimate repair action, and instructs the user to paste-and-run it, leading to code execution. Rapid7 Labs separately documented a large-scale campaign in which an unidentified actor compromises legitimate **WordPress** sites to inject a ClickFix implant that impersonates a **Cloudflare human verification (CAPTCHA)** challenge. The operation has affected **250+** infected sites across **12+ countries** and delivers a **multi-stage, mostly in-memory** malware chain (obfuscated JavaScript → PowerShell stagers → in-memory loaders/shellcode) aimed at stealing **credentials and digital wallets** from Windows systems, enabling downstream financial theft and potential follow-on intrusion using harvested credentials.
Jun 29, 2026