Fast Facts
- Threat actors exploited CVE-2026-26980 in Ghost CMS to inject malicious JavaScript and steal admin API keys, enabling mass content tampering and fake CAPTCHA attacks.
- Over 700 sites across multiple sectors, including finance and AI, were compromised using a large-scale poisoning campaign that delivered dynamic payloads via cloaked JavaScript loaders.
- Attackers used fake CAPTCHA pages and remote command instructions to deliver malware, including DLLs and Electron apps, for persistent remote control and data exfiltration.
Threat, Attack Techniques, and Targets
Threat actors are exploiting a serious security flaw, CVE-2026-26980, in Ghost CMS. This flaw is an SQL injection vulnerability found in the Content API of Ghost CMS. It allows attackers to access the database without permission. The vulnerability was fixed in version 6.19.1 released in February 2026. The exploit was discovered by QiAnXin XLab using Claude.
Attackers use this flaw to steal the admin API key of a website. Once they have the key, they can modify the site. They inject malicious JavaScript code into articles. This code loads payloads from an external domain, clo4shara[.]xyz. These payloads can include malware designed for ClickFix attacks. The threat actors also use fake CAPTCHA pages to trick visitors into executing additional commands.
The campaign is large-scale. It started on May 7, 2026. Over 700 websites have been affected. The affected sites are from sectors such as universities, blockchain, artificial intelligence, software, security research, media, and financial technology. The malicious activity targets visitors as well as website owners.
Impact, Security Implications, and Remediation Guidance
This attack has serious consequences. The malicious injection of JavaScript code can lead to malware infections. It can also enable remote control of visitors’ browsers, leading to further scams or data theft. Websites can be compromised, losing trust and damaging their reputation.
The security flaw reveals how dangerous SQL injection vulnerabilities are. If not fixed, attackers could cause ongoing harm to sites and visitors. The campaign’s broad scope shows how quickly attackers can exploit such vulnerabilities for large attacks.
To reduce risks, owners should upgrade Ghost CMS to version 6.19.1 or later. They should also rotate all website credentials and examine logs for suspicious activity. Cleaning infected sites and alerting users who visited during the attack are important steps. For detailed remediation steps, sites should consult their vendor or security authority to get the latest guidance.
Discover More Technology Insights
Learn how the Internet of Things (IoT) is transforming everyday life.
Access comprehensive resources on technology by visiting Wikipedia.
ThreatIntel-V1
