Ghost CMS Mass Compromised via CVE-2026-26980, Now Fueling ClickFix Attacks

XLab detected a large-scale Ghost CMS poisoning campaign exploiting CVE-2026-26980 to extract Admin API keys and inject JavaScript loaders across 700+ domains; attackers used cloaking services and FakeCaptcha social engineering to distribute multi-stage payloads (including a stealer trojan and persistent Electron backdoor), multiple attack groups are active, and the report includes IoCs, sample analyses, detection checks, and remediation steps.