Loading story…
Google's Blogger platform incorrectly locked large numbers of legitimate blogs under its "Malware and Similar Malicious Content" policy after an apparent automated false positive, leaving affected publishers unable to use key dashboard functions and placing some sites in read-only status. Users began reporting the issue in Google's official help forums, where Product Experts said the internal team had been alerted and that some appealed blogs were already being restored, although some publishers said restored sites were later deleted again.
Community reports indicated the misclassification likely came from Blogger's automated scanning systems flagging benign code in third-party templates as malicious, including copyright-protection or encryption scripts used by popular template providers such as Sora Templates and Gooyaabi. Affected users were told to request manual review through the Blogger dashboard, while unresolved cases risk permanent deletion after 90 days if the lock is not cleared.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
In forum responses, Blogger Product Experts said the incident appeared to be a large-scale false positive caused by Google's automated systems rather than a deliberate crackdown on malicious blogs. They also indicated Google's internal team had been alerted and was working on a fix.
After the lockouts began, hundreds to thousands of affected site owners posted complaints in Google's official Blogger Help Community. The volume and similarity of reports indicated the issue was widespread rather than isolated.
Beginning on August 4, 2026, Google's Blogger platform started locking large numbers of legitimate blogs under its "Malware and Similar Malicious Content" policy. Affected publishers lost access to key dashboard functions, and some blogs were reportedly deleted or made read-only pending review.
Some affected publishers who submitted appeals reported that their blogs were restored. Other users said restored blogs were later deleted again, indicating inconsistent remediation during the incident.
Early community analysis suggested Blogger's scanner may have mistaken copyright-protection encryption scripts in third-party templates, including those from Sora Templates and Gooyaabi, for obfuscated malware. This was presented as a suspected technical cause of the false positives.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcescworld.com
Open sourcexakep.ru
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcesupport.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A cloud-hosted tech-support scam campaign used more than 250 Google Ads campaign IDs to route users through a benign-looking fake “ShopEase” storefront before presenting operating-system-specific security lockers impersonating Microsoft Defender on Windows and Apple on macOS. Between August 31 and September 14, it affected at least 619 organizations, chiefly in the United States, Japan, and Australia, with ads appearing across at least 284 legitimate publisher sites. Victims were pressured to call a fraudulent support number through full-screen browser takeovers, keyboard locking, hidden cursors, warning audio, and intentional browser-performance degradation. The campaign reflects advanced browser-based scareware techniques also documented in CypherLoc, which uses encrypted JavaScript loaders to validate, decrypt, and execute concealed payloads before replacing the initial page with a fake security warning. Such lockers evade automated inspection through interaction checks such as required mouse movement and staged AES decryption of command-and-control details and payloads, while assembling the malicious interface entirely in browser memory. They can further heighten credibility by displaying a victim’s public IP address and fake login forms, while repeatedly relocking the browser when users attempt to recover control.
Sep 28, 2026
Attackers are increasingly targeting legitimate business websites by injecting hidden HTML blocks containing links to third-party sites, often related to pornography or gambling. These hidden links are not visible to regular users but are detected by search engines and security solutions, which can result in the affected websites being miscategorized or flagged as unsafe. The presence of such links is a form of black hat SEO, where attackers manipulate search engine rankings by artificially inflating the link profile of their own or affiliated sites. Website owners are often unaware of the compromise until they notice a sudden drop in web traffic, receive complaints from users, or are alerted by security software that their site is being blocked or categorized as prohibited. The injected links typically contain relevant keywords and point to low-authority, unrelated domains, which further damages the reputation and search ranking of the victim site. Search engines penalize sites hosting these hidden links, causing them to lose visibility in search results and potentially harming their business prospects. The attack is not limited to any particular industry, with cases observed on sites ranging from manufacturers to law firms and online retailers. The technical method involves inserting invisible HTML elements that are ignored by users but parsed by automated systems. Detection can be challenging without specialized tools, but security solutions like those from Kaspersky can identify and block such compromised sites. The impact extends beyond search rankings, as clients may lose trust in the affected business if their security software flags the site or if they are inadvertently exposed to inappropriate content. Remediation involves thoroughly scanning the website’s codebase, removing unauthorized HTML blocks, and strengthening security to prevent future injections. Website administrators are advised to monitor their sites for unusual changes in traffic or categorization and to use reputable security tools for ongoing protection. The incident highlights the importance of regular website audits and prompt response to security alerts. Attackers exploit vulnerabilities in website management or outdated plugins to gain access and insert malicious content. Proactive measures, such as keeping software up to date and restricting administrative access, can reduce the risk of such SEO spam attacks. Ultimately, maintaining a clean and reputable web presence requires vigilance against these evolving black hat SEO tactics.
Jun 29, 2026
Attackers are actively exploiting **CVE-2026-26980**, a critical SQL injection flaw in Ghost CMS, to compromise more than **700 unpatched websites** and turn them into malware delivery platforms. The vulnerability, patched in **Ghost 6.19.1**, allows exposure of the **Admin API key** through the Content API, giving attackers the ability to take over sites and alter published content. Researchers said the campaign has affected organizations across higher education, media, fintech, AI, SaaS, blockchain, and security research, with evidence suggesting the flaw was weaponized almost immediately after disclosure and that at least **two separate threat groups** have been abusing it, sometimes targeting the same sites. The intrusions rely on injected malicious JavaScript that redirects visitors into **ClickFix** social-engineering flows, including fake CAPTCHA or human-verification prompts that instruct users to paste a Base64-encoded command into the Windows Run dialog. The staged infection chain has delivered ZIP, batch, PowerShell, DLL, JavaScript, and Windows executable payloads, with infrastructure including `clo4shara[.]xyz/11z77u3.php` and `web-telegram[.]ug`, and cloaking used to evade detection. Defenders are being urged to **upgrade Ghost immediately**, rotate API credentials, inspect logs for suspicious Admin API activity, remove injected scripts from stored content, and notify visitors who may have been exposed.
Jun 29, 2026