Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign
Attackers are abusing a Ghost CMS SQL injection flaw to steal API keys, inject scripts, and push ClickFix lures across more than 700 sites.
Intelligence analysis by GPT-5.4 Mini
XLab says threat actors are exploiting CVE-2026-26980 in Ghost CMS to steal admin API keys and plant JavaScript that redirects visitors into ClickFix-style malware delivery. The campaign has hit more than 700 domains, including university, media, fintech, and security sites.
A website tool called Ghost had a serious hole in it. Bad actors used that hole to sneak in, steal secret keys, and place tricky code on many websites.
That code could hide a fake check that looked like a normal safety screen. When people followed it, they were told to paste a command into Windows, which could install bad software.
It is like someone finding a spare key to a store, changing the signs inside, and then putting a fake door check at the entrance so visitors hand over the wrong thing.
Analysis
What happened
XLab threat intelligence researchers at Qianxin say a large campaign is exploiting CVE-2026-26980 in Ghost CMS. The flaw affects Ghost 3.24.0 through 6.19.0 and lets unauthenticated attackers read arbitrary data from the site database, including admin API keys.
Those keys matter because they give management access to users, articles, and themes. With that access, attackers can modify article pages and inject malicious JavaScript. Ghost released a fix in version 6.19.1 on February 19, but the article says many sites did not install it.
How the attack works
XLab says the attack chain starts with database access, then moves to script injection. The injected JavaScript acts as a lightweight loader that fetches second-stage code from attacker infrastructure. That second stage fingerprints visitors and decides whether to show them a lure.
If a visitor passes that check, the attacker serves a fake Cloudflare verification page in an iframe over the article. The page tells the target to prove they are human by pasting a command into Windows Command Prompt. That is the ClickFix lure, and it is used to drop malware on the victim machine.
The researchers say they saw at least two activity clusters. In some cases, one group would clean up another group's script and then reinfect the same domain with its own code. XLab reported impact on more than 700 domains, including university portals, AI and SaaS companies, media outlets, fintech firms, security sites, and personal blogs. The article says Harvard University, Oxford University, Auburn University, and DuckDuckGo were among the compromised sites.
What defenders should do
Ghost administrators should upgrade to 6.19.1 or later and rotate any keys that may have been exposed. XLab also recommends reviewing the published indicators of compromise and keeping 30 days of admin API call logs so investigators can reconstruct what happened.
Key points
- XLab says attackers exploited CVE-2026-26980 in Ghost CMS to steal admin API keys.
- The campaign has affected more than 700 domains, including universities, media, fintech, and security sites.
- Attackers injected JavaScript into articles to load second-stage code and fingerprint visitors.
- Victims were shown a fake Cloudflare prompt that led into a ClickFix-style lure.
- Ghost admins are advised to upgrade, rotate keys, review IoCs, and keep admin API logs.
