Critical Ghost CMS CVE-2026-26980 exploited to infect 700 sites with ClickFix malware

Key Takeaways

• A critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS is being actively exploited by multiple threat groups.
• Over 700 websites, including those belonging to major universities like Harvard and Oxford, have been compromised and infected with ClickFix malware.
• Attackers are using the flaw to steal Admin API keys, inject malicious JavaScript into articles, and deliver sophisticated data-stealing payloads through social engineering.
• The vulnerability was disclosed on February 19, 2026, and patches are available.

Widespread Exploitation of Ghost CMS Vulnerability Infects Hundreds of Sites with ClickFix Malware

A severe SQL injection vulnerability within the Ghost Content Management System (CMS) is currently under active exploitation by at least two distinct threat actor groups. These groups are leveraging the flaw, identified as CVE-2026-26980, to surreptitiously compromise more than 700 websites, subsequently exposing site visitors to the dangerous ClickFix malware. The ongoing campaign’s intricate details and broad impact were recently brought to light in a comprehensive report.

Despite public disclosure of CVE-2026-26980 on February 19, 2026, a significant number of Ghost CMS administrators failed to implement the available security patches. This delay created an opportune window for attackers, who swiftly began scanning for unpatched installations. Upon identifying vulnerable targets, threat actors exfiltrated Admin API keys, enabling them to mass-modify article content and embed malicious JavaScript loaders. These loaders then served the ClickFix malware to unsuspecting visitors navigating the compromised websites.

Initial Detection and Campaign Escalation

Security researchers at Qianxin XLab first identified this malicious activity on May 7, 2026, during an investigation into a compromise affecting one of their key clients. What initially appeared to be an isolated incident quickly revealed itself as a widespread, automated campaign targeting Ghost CMS installations globally, as Qianxin detailed in their report shared with Cyber Security News.

The attack chain was described as highly systematic, encompassing several stages: CMS takeover, page poisoning, a two-stage payload loading mechanism, social engineering tactics, and ultimately, the delivery of the final malware. The scope of the attack escalated rapidly. By May 10, researchers had confirmed 156 poisoned domains. Just one week later, this figure surged to over 700 compromised sites, including those associated with prominent academic institutions such as Harvard University, Oxford University, and Auburn University. The affected domains span a diverse range of sectors, including blockchain, artificial intelligence, media, fintech, and cybersecurity research.

A particularly insidious aspect of this campaign is the attackers’ exploitation of user trust in reputable websites. Visitors to the compromised Ghost sites encountered no overt warning signs. The poisoned articles appeared entirely normal, with the malicious code discreetly embedded at the bottom of each page, designed to activate only as a reader scrolled down.

CVE-2026-26980: The Gateway to Compromise

The core vulnerability exploited in this campaign is a critical SQL injection flaw within Ghost CMS, allowing unauthenticated attackers to directly access the database. This access facilitates the extraction of sensitive information, most notably the Admin API Key. With this key, attackers can leverage the Ghost Admin API to programmatically rewrite articles on a large scale, bypassing the need for direct access to the administrative panel or the server itself.

Once the malicious JavaScript loader was successfully injected, the attack progressed through four distinct stages. The first stage involved embedding the loader at the footer of the compromised articles. The second stage employed a sophisticated cloaking script to redirect legitimate visitors while filtering out security researchers and automated bots. In the third stage, users were presented with a highly convincing, fake Cloudflare verification page, designed to trick them into executing a malicious command by pressing WIN+R, pasting the command, and hitting Enter. Finally, the fourth stage silently delivered and executed a data-stealing payload on the victim’s machine.

ClickFix Social Engineering and Payload Delivery

The efficacy of this campaign against ordinary users largely hinges on the highly deceptive fake verification page. This page meticulously replicates the appearance and wording of a legitimate Cloudflare CAPTCHA interface. When users click to “verify,” they unknowingly copy a malicious command to their clipboard and then execute it themselves, under the false impression that they are merely proving their humanity.

The payloads deployed by the attackers evolved throughout the campaign. Early iterations involved downloading a DLL file named installer.dll via a public Content Delivery Network (CDN) and silently executing it using rundll32. By May 16, attackers had upgraded their arsenal to a more advanced, zero-detection data-stealing Trojan, UtilifySetup.exe. This sophisticated malware, built on an Electron-based framework, established persistence on victim machines and communicated with its command-and-control server every 30 seconds.

Researchers also uncovered evidence of a second, parallel campaign being conducted by a separate threat actor group. This group utilized a loader delivered through a ZIP archive named NotepadPlusPlus.zip, suggesting multiple adversaries are exploiting this critical vulnerability.

What You Should Do

• Immediate Patching: All Ghost CMS administrators must upgrade their installations to the patched version that addresses CVE-2026-26980 without delay.
• Credential Rotation: Rotate all administrative credentials, including Admin API keys and administrator passwords, immediately.
• Audit Logs: Scrutinize access logs for any unusual or unauthorized bulk PUT requests.
• Content Scan: Scan all article content for suspicious fingerprints, such as ghost_once_footer_ or combinations of atob( with appendChild.
• User Device Scan: Visitors who accessed any potentially affected Ghost website during the contamination period should perform a comprehensive security scan on their local devices.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.