Reported by 1 outlet
Ghost CMS SQL Injection Exploited in Large-Scale ClickFix Campaign — 700+ Domains Including Harvard, Oxford, DuckDuckGo Compromised
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Ghost CMS SQL Injection Exploited in Large-Scale ClickFix Campaign — 700+ Domains Including Harvard, Oxford, DuckDuckGo Compromised
bleepingcomputer.com · 142d ago · May 25th, 2026
A critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS is being actively exploited in a large-scale campaign impacting over 700 domains discovered by XLab at Qianxin. The flaw, patched on February 19 in Ghost 6.19.1 but still unpatched on thousands of sites, allows unauthenticated attackers to steal admin API keys and inject malicious JavaScript into published articles.
The attack chain exploits the SQLi to exfiltrate admin API keys, then uses elevated rights to inject a JavaScript loader that fingerprints visitors. Qualifying targets are served a fake Cloudflare prompt via iframe, instructing them to paste a PowerShell command — the ClickFix lure — which drops DLL loaders, JavaScript droppers, or an Electron-based malware sample named
UtilifySetup.exe. Compromised targets include Harvard University, Oxford University, Auburn University, and DuckDuckGo.