More than 700 education and technology websites hijacked in a large ClickFix malware campaign

Attackers abused a critical SQL injection vulnerability in Ghost to hijack more than 700 websites and add a fake Cloudflare or CAPTCHA verification step. Visitors were tricked into pasting and running a Windows command or PowerShell command, resulting in malware installation.