A massive cyberattack has compromised over 700 websites running Ghost CMS, including portals for prestigious universities like Harvard and Oxford.
Discovered by security researchers at XLab on May 7, 2026, the campaign exploits a critical vulnerability to inject malicious JavaScript.
This code powers a sophisticated “ClickFix” social engineering attack that tricks visitors into installing a virtually undetectable infostealer.
Threat actors are actively scanning for unpatched Ghost CMS instances to extract Admin API Keys without authorization. Armed with these keys, attackers use the Ghost Admin API to append malicious scripts to the bottom of published articles silently.
Astonishingly, XLab researchers observed at least two rival hacking groups fighting for control over the same vulnerable websites, rapidly overwriting each other’s malicious payloads.
Ghost CMS Flaw Abused
The infection process relies heavily on social engineering rather than traditional browser vulnerabilities. Once a user visits a compromised Ghost website, the injected script redirects them to a highly convincing, fake Cloudflare security page.
This fraudulent “Verify you are human” prompt guides victims through a dangerous sequence:
- Press WIN+R to open the Windows Run dialog.
- Press Ctrl+V to paste a pre-copied command.
- Press Enter to execute the malicious script.
If a user follows these steps, they unknowingly trigger a hidden PowerShell command. This command downloads a ZIP archive (often disguised as update.zip or NotepadPlusPlus.zip), extracts an installer DLL, and executes it silently in the background.
The final payload is UtilifySetup.exe, a malicious Electron application with zero detections on VirusTotal.
This Trojan establishes persistence on the host machine and continuously polls a remote command-and-control server, allowing attackers to execute arbitrary code or steal sensitive data.
To evade detection, attackers use sophisticated cloaking services. The malicious payload only triggers for genuine victims based on browser fingerprints. At the same time, security scanners and researchers are served harmless web pages.
With the attacks escalating and multiple threat groups involved, site administrators must act immediately to secure their infrastructure.
Removing the malicious scripts from the website editor is not enough, as attackers maintain persistent backdoor access via the stolen API keys.
Upgrade Ghost CMS immediately to the latest patched version to close the SQL injection flaw. Rotate all credentials, including Admin API Keys, Content API Keys, and administrator passwords.
Clean injected content by auditing the database to remove unrecognized <script> tags from all posts. Audit access logs for suspicious PUT /ghost/api/admin/posts/:id/ requests originating from unknown IP addresses.
Indicators of Compromise
| Indicator Type | Value |
|---|---|
| Cloaking Domain | clo4shara[.]xyz |
| Cloaking Domain | com-apps[.]cc |
| Malicious URL | cloud-verification[.]com/update.zip |
| Malicious URL | taketwolabs[.]com/wp-content/NotepadPlusPlus.dll |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
