Ghost CMS CVE-2026-26980 exploited to hijack 700+ sites in ClickFix campaign

Du'aine Davis

Observed in the wild

• On 7 May, XLab reported a large-scale campaign exploiting CVE-2026-26980 to compromise over 700 Ghost CMS websites across sectors including education, SaaS, media, and universities. Attackers injected malicious scripts into site content, turning trusted websites into malware delivery platforms.
• Attackers exploited an unauthenticated SQL injection to steal Ghost Admin API keys, enabling bulk content tampering. They injected JavaScript loaders that redirected users via cloaking infrastructure to deceptive Cloudflare verification pages (ClickFix). Users were tricked into executing commands that downloaded and ran payloads (DLLs, ZIPs, EXEs) via PowerShell and rundll32. At least two groups operated concurrently, using multi-stage loaders, fingerprinting, and dynamic payload delivery.
• Organisations are advised to urgently patch Ghost CMS and rotate all API keys and credentials. Defender should be used to monitor for abnormal PowerShell spawning, rundll32 execution from temp directories, and suspicious ZIP/DLL downloads. Detect unusual browser-driven command execution (WIN+R activity), outbound connections to newly registered domains, and anomalous CMS API activity (e.g. bulk POST/PUT edits). Review logs for injected scripts and enforce tamper detection on web content.

Ghost CMS Mass Compromised via CVE-2026-26980, Now Fueling ClickFix Attacks