Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign

A large-scale campaign is exploiting the critical Ghost CMS SQL injection vulnerability CVE-2026-26980 to steal administrator API keys and inject malicious JavaScript that triggers ClickFix attack flows. More than 700 domains were affected, including university portals, AI and SaaS companies, media outlets, fintech firms, security sites, and personal blogs.