Ghost CMS Exploitation and ClickFix Malware Campaign

In May 2026, a large-scale campaign was identified targeting Ghost CMS instances via CVE-2026-26980, a high-risk SQL injection vulnerability. Attackers exploit this flaw to steal Admin API Keys, enabling them to bulk-modify website content by injecting malicious loaders. These loaders facilitate 'ClickFix' or 'FakeCaptcha' attacks, where users on high-trust sites are presented with forged Cloudflare verification pages that trick them into executing malicious PowerShell commands.

The campaign involves at least two distinct threat groups, including one linked to Aeternum, competing for control over compromised domains. Over 700 domains have been affected, including prestigious academic institutions and fintech companies. The final payloads include stealer trojans and persistent Electron-based malware that uses automated C2 communication for instruction retrieval.

This incident highlights the critical risk of unpatched CMS vulnerabilities. Because the attackers utilize legitimate site reputations, the success rate of the social engineering component is significantly elevated. Immediate patching of Ghost CMS and rotation of all API credentials is required for affected organizations.