Ghost CMS CVE-2026-26980 Exploited to Target 700+ Sites with ClickFix Attacks
Summary
QiAnXin XLab reports that attackers used Ghost CMS CVE-2026-26980 to steal admin API keys and inject ClickFix loaders across 700+ sites, delivering Windows malware. Ghost fixed the flaw in version 6.19.1.
Key points
- QiAnXin XLab says at least two threat clusters were behind the campaign, first detected on May 7, 2026, which affected more than 700 websites across multiple sectors.
- CVE-2026-26980 is an unauthenticated SQL injection in Ghost’s Content API that can expose database data. Ghost addressed it in version 6.19.1 in February 2026.
- Attackers used stolen admin API keys to alter published articles and inject malicious JavaScript loaders.
- The loaders retrieve payloads through a cloaking script at clo4shara[.]xyz/11z77u3.php; the script fingerprints browsers and serves fake CAPTCHA pages to intended targets while showing benign content to scanners.
- The fake CAPTCHA triggers a ClickFix attack that tells visitors to run a Base64-encoded command in Windows Run, leading to batch and PowerShell scripts that download and launch malware.
- Payloads include a signed PuTTY binary or an installer for a modified Grape desktop client. The client is designed to persist and poll web-telegram[.]ug every 30 seconds for attacker instructions.
- XLab advises Ghost users to upgrade, rotate credentials, clean affected sites, audit access logs, and notify potentially affected visitors.
Article Details
- Attack Vectors
- Exploitation of CVE-2026-26980, an unauthenticated SQL injection vulnerability in Ghost CMS’s Content API, to obtain admin API keys and modify published articles.
- Injected JavaScript loaders retrieve a cloaking script that fingerprints visitors and selectively serves fake CAPTCHA pages.
- The fake CAPTCHA prompts victims to paste a Base64-encoded command into the Windows Run dialog, initiating a chain that downloads and executes payloads.
- Payloads use a batch script and PowerShell to download and launch a DLL with rundll32.exe, or deliver a JavaScript payload that installs a modified Grape client.
- The modified Grape client polls a remote server for instructions to run JavaScript or executable files.
- Defensive Notes
- Upgrade Ghost CMS to the latest version; the article says CVE-2026-26980 was addressed in version 6.19.1.
- Rotate all credentials, clean up compromised sites, and audit access logs for suspicious activity.
- Notify users who may have visited affected sites during the contamination period about potential compromise.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | web-telegram[.]ug | Remote server polled by the modified Grape client every 30 seconds for attacker instructions. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe command victims are told to paste is Base64-encoded.T1059.001 · PowerShellThe batch script runs a PowerShell command to download a DLL.T1059.003 · Windows Command ShellA downloaded Windows batch script is executed as part of the payload chain.T1059.007 · JavaScriptThe modified Grape client can run JavaScript code received through attacker instructions.T1105 · Ingress Tool TransferThe attack downloads a ZIP archive and later a DLL from remote infrastructure.T1189 · Drive-by CompromiseInjected JavaScript on compromised websites selectively presents visitors with fake CAPTCHA pages that initiate the attack.T1190 · Exploit Public-Facing ApplicationAttackers exploit the unauthenticated SQL injection in Ghost CMS’s Content API to obtain admin API keys.T1204.004 · Malicious Copy and PasteVictims are instructed to copy and paste a Base64-encoded command into the Windows Run dialog.T1218.011 · Rundll32The downloaded DLL is launched using rundll32.exe.
CVE
Products
Adspect#GhostCMSGhost CMSThreat actors are exploiting CVE-2026-26980 in Ghost CMS to steal admin API keys, inject malicious JavaScript, and fuel large-scale ClickFix attacks across more than 700 compromised websites.GrapeThe campaign uses cloaking, fake CAPTCHA pages, and multiple loaders to deliver payloads and eventually drop Windows malware, including a modified Grape desktop client and a signed PuTTY binary.PuTTYThe campaign uses cloaking, fake CAPTCHA pages, and multiple loaders to deliver payloads and eventually drop Windows malware, including a modified Grape desktop client and a signed PuTTY binary.
Tools
PowerShellThe malware chain uses cloaking, PowerShell, DLLs, JavaScript payloads, and a modified Grape client for persistence.Rundll32The script, for its part, executes a PowerShell command to download a DLL file from a remote domain, launch it using “rundll32.exe,” and open a bogus web page to the user as a distraction.
Industries
Artificial intelligenceIn all, the campaign has compromised more than 700 websites, spanning universities, blockchain, artificial intelligence, software-as-a-service (SaaS), security research, media, and financial technology sectors.BlockchainIn all, the campaign has compromised more than 700 websites, spanning universities, blockchain, artificial intelligence, software-as-a-service (SaaS), security research, media, and financial technology sectors.Financial TechnologyIn all, the campaign has compromised more than 700 websites, spanning universities, blockchain, artificial intelligence, software-as-a-service (SaaS), security research, media, and financial technology sectors.MediaThe campaign has affected more than 700 websites across universities, media, fintech, and other sectors.Security researchIn all, the campaign has compromised more than 700 websites, spanning universities, blockchain, artificial intelligence, software-as-a-service (SaaS), security research, media, and financial technology sectors.Software-as-a-serviceIn all, the campaign has compromised more than 700 websites, spanning universities, blockchain, artificial intelligence, software-as-a-service (SaaS), security research, media, and financial technology sectors.UniversitiesThe campaign has affected more than 700 websites across universities, media, fintech, and other sectors.