The Ghost CMS campaign is a clear reminder that a CMS vulnerability does not only put the website at risk. It can turn trusted websites into malware delivery infrastructure. In this case, attackers are exploiting CVE-2026-26980, a critical SQL injection flaw in Ghost CMS, to steal admin API keys and inject malicious JavaScript into articles. The campaign has reportedly affected 700+ domains, including university portals, AI/SaaS companies, media sites, fintech firms, security sites, and personal blogs.

The attack chain is especially concerning because visitors are targeted through a ClickFix lure. After the malicious JavaScript is injected, users may see a fake Cloudflare-style verification prompt that asks them to paste a command into Windows Command Prompt. That command then drops malware, including DLL loaders, JavaScript droppers, and an Electron-based payload named UtilifySetup.exe. Because apparently fake “prove you are human” screens are now proving only that humans can be talked into running malware manually. 

Ghost administrators should immediately upgrade to version 6.19.1 or later, because the fix was released on February 19, 2026, and many sites still failed to patch. Admin API keys should also be rotated, since the vulnerability can expose them and allow attackers to modify articles, themes, and users. Site owners should review for injected scripts, check admin API call logs, and retain at least 30 days of admin API logs for retrospective investigation. 

The broader lesson is simple: website security is now endpoint security too. A compromised CMS can be used to infect visitors, steal credentials, distribute malware, and damage brand trust. Organizations should patch internet-facing platforms quickly, monitor content integrity, restrict admin access, use WAF and DNS filtering, and watch for unauthorized JavaScript changes. A trusted website becomes dangerous the moment attackers are allowed to edit what users load in their browsers.

A large-scale campaign is exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS to inject malicious JavaScript code that triggers ClickFix attack flows. [...]

Source: Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign via Bleeping Computer — published 24 May 2026.