Ghost CMS CVE-2026-26980 Used to Compromise 700+ Websites in ClickFix Campaign
Attackers have been exploiting a high-severity vulnerability in Ghost CMS to insert malicious JavaScript into numerous sites, enabling large-scale ClickFix social-engineering campaigns. Security researchers at QiAnXin XLab link the activity to CVE-2026-26980, an SQL injection flaw in Ghost’s Content API that received a CVSS score of 9.4 and could allow unauthenticated actors to read arbitrary database contents.
The bug was fixed in February 2026 with the release of Ghost 6.19.1. Anthropic, using the Claude model, is credited with identifying the issue. What raises the stakes for this vulnerability is that it can be leveraged to retrieve a site’s Admin API key without authorization, giving attackers the ability to modify site content and embed malicious assets.
According to XLab, the intruders used the flaw to obtain Admin API keys and then employed the Ghost Admin API to alter many articles at once, appending JavaScript loaders to pages that support fraudulent CAPTCHA flows. The Chinese vendor describes the operation as a “large-scale poisoning” campaign, attributing the activity to at least two separate threat clusters; in some incidents, sites were injected with malicious code within a single day. XLab first observed the campaign on May 7, 2026.
More than 700 websites have been impacted so far, spanning universities, blockchain projects, artificial-intelligence firms, SaaS companies, security research organizations, media outlets, and fintech services. XLab warns that the presence of malware on legitimate and trusted domains likely increases the success rate of the ClickFix scheme.
The injected JavaScript appended to compromised articles acts as a two-stage loader: it pulls the main payload at runtime from an external URL (notably clo4shara[.]xyz/11z77u3.php). This modular setup lets the attackers swap backend payloads while keeping the lightweight loader identical across multiple infected pages.
When researchers accessed clo4shara[.]xyz/11z77u3.php, they found a traffic-distribution script that fingerprints browsers and sends that telemetry back to the operator, which then decides whether to redirect the user, show popups, or trigger downloads. XLab notes the PHP component is built on Adspect, a commercial cloaking product; the cloaker’s role is to serve the real malicious payload only to carefully profiled targets while presenting innocuous content to crawlers and scanners.
The cloaking script supports around 19 different commands that can inject arbitrary JavaScript and remotely control the victim’s browser. Targeted visitors are shown a fake CAPTCHA page inside an iframe and instructed to copy a Base64-encoded string into the Windows Run dialog – the core of the ClickFix social-engineering ploy.
That pasted command acts as a dropper: it downloads a ZIP archive, extracts a Windows batch file and executes it. The batch file runs a PowerShell command to fetch a DLL from a remote host, launches it via rundll32.exe, and opens a decoy web page to distract the user. Later variants have swapped the DLL for a JavaScript-based payload, but the ultimate goal remains the same: deliver a Windows executable to the infected machine.
In campaigns where a DLL was used, the final binary was a PuTTY client signed with a legitimate code-signing certificate. When distributed through the JavaScript route, the payload was an Inno Setup installer wrapping a modified Electron application – a fork of the open-source Grape desktop client – repackaged to persist on the victim system and poll a command server every 30 seconds.
The backdoored Electron client communicates with a command-and-control host (identified as web-telegram[.]ug) and can execute attacker directives such as running JavaScript snippets or launching arbitrary executables. This polling behavior gives the operators ongoing remote control over compromised endpoints.
Ghost administrators should immediately update any instances to the latest Ghost release, invalidate and rotate all API keys and passwords, and remove injected code from pages. Organizations are also advised to review access logs for unusual activity, perform a thorough site cleanup, and notify users who visited infected pages during the exposure window so they can check for potential compromise.