CTI Daily Brief — 2026-05-25

Large-scale ClickFix campaign mass-compromises self-hosted Ghost CMS sites via CVE-2026-26980

XLab researchers at Qianxin documented an active, large-scale campaign weaponising the unauthenticated SQL-injection flaw CVE-2026-26980 against self-hosted Ghost CMS instances, with more than 700 compromised domains observed — among them university portals (Harvard, Oxford and Auburn are named), AI/SaaS companies, media outlets, fintech firms, security sites and personal blogs, plus DuckDuckGo (BleepingComputer, 2026-05-24; XLab Qianxin, 2026-05-21). The intrusion is a two-stage operation: the attacker first exploits the pre-auth SQLi in Ghost's Content API to read the admin API key out of the database, then uses that key — which carries full content-management scope — to inject a lightweight JavaScript loader into published articles. The loader pulls a second-stage cloaking script that fingerprints each visitor; those who qualify are served a fake Cloudflare "verify you are human" prompt in an iframe overlaid on the article (the ClickFix / FakeCaptcha pattern) instructing them to paste a supplied command into the Windows Run dialog, which drops DLL loaders, JavaScript droppers, or an Electron-based sample (UtilifySetup.exe) (BleepingComputer, 2026-05-24).

Why it matters to us: self-hosted Ghost is used across EU/CH universities, NGOs and independent media — exactly the named victim profile — and the campaign weaponises a flaw patched back in February (6.19.1) against the still-unpatched long tail. The threat is two-sided: site operators face server-side compromise and admin-key theft (rotate the key and audit posts/themes for injected <script> even after patching, per § 2 and § 5), while every visitor to a compromised site is a ClickFix target. The client-side execution chain is the higher-value, product-agnostic hunt — cmd.exe / powershell.exe spawned from a browser process tree following a Run-dialog paste — and is worth hunting regardless of whether you run Ghost (see § 5).

CVE-2026-26980 — Ghost CMS Content API: unauthenticated blind SQL injection in the `slug` filter, actively exploited

CVE-2026-26980 is an unauthenticated SQL injection (CWE-89) scored CVSS 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) in Ghost's Content API. The defect sits in the handling of the slug filter parameter, which is interpolated into a raw SQL fragment without parameterisation; a remote attacker with no authentication can perform boolean-based blind extraction of arbitrary database contents — critically the admin API key, which then grants full content-management scope over articles, themes and users (GitHub Security Advisory GHSA-w52v-v783-gw97). Affected versions span Ghost 3.24.0 through 6.19.0 (a roughly three-year release range); the fix shipped in 6.19.1 on 19 February 2026. Ghost(Pro) cloud instances were patched server-side; self-hosted operators must upgrade themselves, which is the exposed long tail the current campaign targets (BleepingComputer, 2026-05-24).

The CVE clears the § 2 bar on exploitation: SentinelOne documented in-the-wild exploitation as early as 27 February, and XLab confirmed the present large-scale wave (700+ compromised domains) on 21 May (XLab Qianxin, 2026-05-21). Mitigation: upgrade to 6.19.1 or later. Interim compensating controls — block Content API requests whose query string contains slug:[ (URL-encoded slug%3A%5B) at the WAF and restrict or disable the public Content API to trusted origins; the vendor mitigation targets exactly that request pattern. Because the admin API key is the exfiltration target, treat it as compromised on any exposed instance and rotate it after patching, then audit posts and themes for injected JavaScript. Full kill chain and detection in § 5.

CVE Summary Table

"Underminr": a multi-tenant-CDN domain-fronting variant that blinds DNS-layer filtering

ADAMnetworks disclosed Underminr, a structural evolution of domain fronting that abuses the shared-IP, multi-tenant architecture of modern CDN edges rather than a single-CDN misconfiguration (ADAMnetworks, 2026-05-21). Classic domain fronting — overriding the HTTP Host header behind a permitted SNI — was largely closed by the major CDNs in 2021–2022 by enforcing SNI/Host consistency. Underminr instead presents the SNI and HTTP Host of a legitimate, allow-listed domain hosted on a shared edge while forcing the request to the IP of a different tenant — the attacker's origin — on the same edge, exploiting the fact that the CDN's internal tenant routing is decoupled from the network-visible Host/SNI (SecurityWeek, 2026-05-23). As SecurityWeek frames it, "the detection gap appears when DNS decisions, edge IPs, SNI, Host headers, and CDN tenant routing are not correlated." No CVE was assigned — this is an architectural property of shared-edge multi-tenancy, not a software bug. SecurityWeek reports roughly 88 million domains on shared infrastructure are potentially in scope, with US, UK and Canadian infrastructure most affected; the technique does not require compromising the legitimate domain, only co-tenancy on the same edge IP range.

Why it matters to us: this maps to ATT&CK T1090.004 (Proxy: Domain Fronting) and is squarely a C2 / exfiltration-evasion concern for the many CH/EU public-sector networks whose egress control leans on DNS-layer filtering (DNS RPZ, recursive-resolver allow-lists) or that treat a CDN's published IP range as a proxy for the actual destination — both of which Underminr defeats, because the FQDN legitimately resolves to the shared edge IP and edge-terminated TLS inspection never sees the origin-routing decision. Defenders should stop treating DNS/domain allow-listing as a sufficient egress control on its own; correlate SNI, Host, the resolved edge IP and (where available) CDN tenant identity per flow, and prefer per-flow identity verification (ZTNA) over perimeter-DNS-filter trust. Specific vulnerable CDN providers are not named in the public reporting.

UPDATE: ShinyHunters lists Charter Communications (Spectrum) — telco victim in the Salesforce-credential campaign

UPDATE (Salesforce-credential extortion campaign, originally covered 2026-05-19 via the 7-Eleven breach): ShinyHunters listed Charter Communications — operating consumer services under the Spectrum brand — on its leak site around 22–23 May, claiming over 42 million PII records and setting a 27 May negotiation deadline before threatened release (CyberInsider, 2026-05-23). The 42M figure is the actor's own unverified leak-site claim. Charter issued a narrowly-worded statement confirming it is "following security protocols" and "alerting appropriate authorities" while explicitly denying that "sensitive personal information (PI) or customer proprietary network information (CPNI)" was exfiltrated — language calibrated to FCC-protected categories. The exclusion of non-CPNI PII (billing name, address, email) from that denial is conspicuous and leaves room for lower-sensitivity data exposure even if the denial holds.

By our own campaign tracking Charter is the first telco/ISP victim of this wave to respond publicly — an inference from the prior named victims (Instructure, Vimeo, Wynn, Vercel, Medtronic, 7-Eleven), none of them telcos, rather than a claim made by the cited sources. The pattern is consistent with the broader ShinyHunters wave against enterprise Salesforce tenants — abuse of exposed OAuth tokens and misconfigured connected-app / Experience Cloud integrations, not a vulnerability in Salesforce itself — the same vector behind the confirmed 7-Eleven breach (600k records, covered 2026-05-19). The fresh Charter listing is independently corroborated by Troy Hunt's Weekly Update 505, 2026-05-24, which records ShinyHunters' new claimed victims. For CH/EU public bodies running Salesforce: audit connected-app OAuth scopes, rotate long-lived connected-app credentials, restrict Experience/Community Cloud guest-user access, and baseline bulk-object query volumes via Shield Event Monitoring — an anomalous large SELECT against Account/Contact objects is the data-exfiltration signature to alert on.