Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for Click Fix Attacks
Summary: Threat actors exploited CVE-2026-26980, a CVSS 9.4 SQL injection in Ghost CMS's Content API patched in version 6.19.1 in February 2026, to obtain sites' Admin API keys and inject malicious JavaScript loaders into articles in bulk. First detected on May 7, 2026, the campaign compromised more than 700 websites across universities, blockchain, AI, SaaS, security research, media, and fintech, with SicuraNext later finding 284 of 287 injected Ghost hostnames pointing to two previously unreported C2 domains.
Bottom line: More than 700 legitimate sites were poisoned, and 17 of them had already updated to the latest Ghost version, because patching does not remove an injection already stored in site content. The loader pulls its payload at runtime from a cloaking service that shows scanners a benign page, so the compromise persists until the content is cleaned and the Admin API key is rotated.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-26980
- Related
- Anthropic Expands Claude Access for Vetted Cyber Teams as Glasswing Finds 129,000 Flaws Cyber Risks ·University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026