Ghost CMS CVE-2026-26980: 700 Sites Poisoned With ClickFix

Ghost CMS CVE-2026-26980: 700 Sites Poisoned With ClickFix

A critical SQL injection vulnerability in Ghost CMS has been mass-exploited to inject ClickFix malware into over 700 legitimate websites, including domains operated by Harvard, Oxford, and Auburn University. The flaw, tracked as CVE-2026-26980, was publicly disclosed in February 2026. Many Ghost administrators never patched it. By late May, researchers at Qianxin XLab confirmed the scope had ballooned from 156 poisoned domains to over 700, with two distinct threat actor groups running parallel campaigns through the same vulnerability.

This is not a hypothetical supply chain risk. This is a verified, in-the-wild exploitation of a known CVE with a known patch, and the blast radius includes some of the most trusted domain names on the internet. Full technical analysis is available from Cyber Security News and Rescana.

The Vulnerability: CVE-2026-26980 Explained

CVE-2026-26980 is an unauthenticated blind SQL injection flaw in the Ghost CMS Content API, affecting versions 3.24.0 through 6.19.0. The severity is high. An attacker with no credentials can read directly from the backend database, including the Admin API Key. With that key, the attacker gains full administrative access through the Ghost Admin API and can silently rewrite published articles at scale — no admin panel login required, no server access needed.

The vulnerability was publicly disclosed on February 19, 2026, with a patch available. Despite this, enough Ghost installations remained unpatched three months later for attackers to compromise 700+ domains. According to Rescana’s exploitation alert, the entire attack chain — from reconnaissance to payload delivery — was automated, enabling mass exploitation at a scale rarely seen in CMS-specific campaigns.

Attack Chain: From SQL Injection to Data Theft

The campaign follows a systematic four-stage pipeline that Qianxin XLab first detected on May 7, 2026, while investigating a compromise at one of their customers. What looked like a targeted intrusion turned out to be a broad, automated campaign hitting Ghost CMS installations worldwide.

Stage 1: Automated Recon and Exploitation

Attackers scan for unpatched Ghost CMS instances. They exploit CVE-2026-26980 to extract the Admin API Key from the database via blind SQL injection. This is fully automated and requires no human interaction on the attacker’s side.

Stage 2: Mass Article Poisoning

Using the stolen Admin API Key, attackers call the Ghost Admin API to silently append malicious JavaScript to published articles. The code is typically obfuscated with base64 encoding and uses dynamic script loading. The articles look completely normal — the malicious payload sits at the bottom of each page, invisible to casual inspection. Ghost CMS site owners should search article content for fingerprints such as ghost_once_footer_ or the combination of atob( with appendChild.

Stage 3: ClickFix Social Engineering

When a visitor loads a poisoned article, the injected JavaScript acts as a loader that fetches a second-stage script from attacker-controlled domains. A cloaking layer — using commercial services like Adspect — filters out security researchers and bots, showing the malicious payload only to real visitors. The payload displays a fake Cloudflare CAPTCHA verification page, mimicking the real interface down to visual styling and wording.

When users click to “verify,” a malicious command is silently copied to their clipboard. They are then instructed to press Win+R, paste the command, and hit Enter. The user executes the malware voluntarily, which is why ClickFix bypasses most endpoint protections.

Stage 4: Payload Delivery

Two distinct threat actor groups were identified running parallel campaigns through the same vulnerability:

• Threat Actor A — Initially delivered installer.dll via a public CDN, launched via rundll32. By May 16, they upgraded to UtilifySetup.exe, a zero-detection Electron-based data stealer that beacons to its C2 server (web-telegram[.]ug) every 30 seconds.
• Threat Actor B — Used domains including staticcloudflare[.]pro, script-dev[.]digital, and script-dev[.]buzz as malicious CSS loader hosts. Their loader used a reverse-string obfuscation technique: the C2 address was stored as sj.ssc/ipa/orp.eralfduolccitats, decoded at runtime via JavaScript’s .split('').reverse().join('') to reconstruct staticcloudflare.pro/api/css.js. A parallel campaign was delivered through a NotepadPlusPlus.zip archive.

As Cyber Security News reported, the payloads evolved over the campaign’s lifespan, indicating active development and testing by both threat actor groups.

Why 700 Sites Fell to a Patched Vulnerability

The uncomfortable truth: CVE-2026-26980 had a patch available for three months before the mass exploitation peaked. The 700+ compromised sites represent administrators who either didn’t know about the patch, couldn’t apply it due to dependency constraints, or deprioritized CMS security relative to other infrastructure.

The scope expanded at an alarming rate. Qianxin XLab confirmed 156 poisoned domains by May 10, which grew to 700+ within one week. The affected sites span dozens of industries: blockchain, AI, media, fintech, security research, and higher education. Universities were disproportionately represented — Harvard, Oxford, and Auburn all had subdomains serving ClickFix payloads.

According to AI Weekly’s alert system, the compromised Harvard subdomains hosted the reverse-string loader that connected to staticcloudflare[.]pro. Visitors to these pages had no visible warning signs — the poisoned articles looked completely normal.

For security teams, the lesson is structural: CMS patching is not optional infrastructure work. When your CMS runs on a subdomain of a trusted institution, a compromise turns that trust into a weapon against your visitors.

Detection and Mitigation Playbook

If you run Ghost CMS or manage web infrastructure that could be affected, here’s what to do now — prioritized by urgency.

Immediate Actions

• Patch Ghost CMS. Upgrade to the version that resolves CVE-2026-26980. This is the single most effective action.
• Rotate all credentials. Admin API keys, administrator passwords, database credentials. Assume they were extracted.
• Audit access logs for unusual bulk PUT requests to the Ghost Admin API, which would indicate mass article modification.
• Scan article content for IOCs: the string ghost_once_footer_, atob( combined with appendChild, or base64-encoded blobs appended to article content.

Network-Level Defenses

• Block C2 domains at DNS/firewall level: staticcloudflare[.]pro, script-dev[.]digital, script-dev[.]buzz, com-apps[.]cc, web-telegram[.]ug, clo4shara[.]xyz, cloud-verification[.]com, updatesecurity[.]pro.
• Hunt for the obfuscation pattern. Search web application and CDN logs for scripts containing .split('').reverse().join('') — a high-fidelity indicator of Threat Actor B’s loader.

Endpoint Defenses

• Monitor PowerShell spawning from browsers. Any powershell.exe process initiated by or receiving input from a browser process should trigger a critical alert. This is the signature behavioral indicator of ClickFix.
• Enable PowerShell Constrained Language Mode to prevent arbitrary downloaded code execution.
• Ensure Windows AMSI is active for additional PowerShell content scanning before execution.
• Flag rundll32 loading unsigned DLLs from temp directories — Threat Actor A’s early payload used this pattern.

User Education

The ClickFix technique relies entirely on user compliance. Train users to never paste commands from websites into terminal windows or the Run dialog, regardless of how legitimate the prompt looks. A real Cloudflare CAPTCHA will never ask you to press Win+R and paste a command.

The Structural Problem: Trust as an Attack Surface

This campaign exposes a weakness that no single organization can fix alone. When 700+ legitimate websites — including domains belonging to Harvard and Oxford — silently serve malware to their visitors, the trust model that underpins web browsing is compromised at scale.

The poisoned sites pass reputation checks. They appear in allowlists. They’re indexed by search engines. Your users visit them in the normal course of work. BleepingComputer’s walkthrough of a real ClickFix attack demonstrates how the technique starts in the browser and ends in malware — with the user as the unwitting execution vector.

For cloud security teams, the takeaway is blunt: perimeter trust is not a security control. Legitimate sites get compromised. Reputable domains serve malicious payloads. The question isn’t whether your users will encounter ClickFix — it’s whether your endpoint detection stack catches the second-stage behavior when the first stage walks right through every filter you’ve built.

As TechRadar notes, the combination of a known CMS vulnerability with the ClickFix social engineering technique creates a dual threat that requires both infrastructure-level patching and user-level awareness to address effectively.

Indicators of Compromise

Frequently Asked Questions

What is CVE-2026-26980?

CVE-2026-26980 is a high-severity unauthenticated blind SQL injection vulnerability in the Ghost CMS Content API, affecting versions 3.24.0 through 6.19.0. It allows attackers to extract the Admin API Key from the database without any credentials, enabling full administrative access and mass modification of site content. A patch is available and all Ghost CMS administrators should upgrade immediately.

What is the ClickFix social engineering technique?

ClickFix is a social engineering method where attackers display fake verification prompts — typically mimicking Cloudflare CAPTCHA pages — on compromised websites. The prompt tricks users into copying a malicious command to their clipboard and pasting it into the Windows Run dialog or a terminal. Because the user executes the code voluntarily, it bypasses most endpoint security controls. There is no CVE for ClickFix itself — it exploits human behavior, not software.

Which universities were affected by this campaign?

Researchers confirmed that subdomains belonging to Harvard University, Oxford University, and Auburn University were among the 700+ sites compromised through CVE-2026-26980. The malicious JavaScript was silently injected into published articles. The institutions’ main infrastructure was not breached — the compromise was limited to specific subdomains running vulnerable Ghost CMS installations.

How do I check if my Ghost CMS site is compromised?

Audit your article content for the string ghost_once_footer_ or combinations of atob( with appendChild. Check Ghost Admin API access logs for unusual bulk PUT requests that would indicate mass article modification. Rotate all credentials including Admin API keys and administrator passwords. Upgrade to the patched version of Ghost CMS that resolves CVE-2026-26980.

References

• Cyber Security News — Hackers Exploit Ghost CMS CVE-2026-26980 to Poison 700 Websites With ClickFix Malware
• Rescana — Active Exploitation Alert: Ghost CMS CVE-2026-26980 Mass Attack Hijacks 700+ Sites
• BleepingComputer — Inside a Real ClickFix Attack: How This Social Engineering Hack Unfolds
• TechRadar — Ghost CMS Flaw Hijacked to Target Hundreds of Websites With ClickFix Attacks
• AI Weekly — Harvard Among 140 Sites Hijacked for ClickFix Malware
• Cyber Press — Ghost CMS Flaw Abused to Poison 700 Websites With ClickFix Malware
• CybelAngel — CVE-2026-26980 Ghost CMS Flaw