Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
28 IOCs
Ghost CMS Mass Compromised via CVE-2026-26980, Now Fueling ClickFix Attacks
Malware Families
Excerpt
Background On May 7, 2026, XLab detected a poisoning incident targeting Ghost CMS belonging to one of important clients. The attacker exploited the high-risk SQL injection vulnerability CVE-2026-26980 in Ghost CMS to obtain the target site's Admin API Key without authorization, and then used the Ghost Admin API to tamper with articles in bulk, injecting malicious JavaScript loaders at the bottom of the pages to assist FakeCaptcha attacks — that is, by forging…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →28 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | updatefilescf.top | High | Score 81/100 | First seen |
| SHA1 | 9434fe686801742ef7d6da248fb0b900dc32208a | High | Score 56/100 | First seen |
| Domain | updatefile-cf.top | High | Score 79/100 | First seen |
| URL | https://jalwat.com/static/uploads/campaigns/6/update.zip | High | Score 63/100 | First seen |
| URL | https://com-apps.cc/NotepadPlusPlus.zip | High | Score 63/100 | First seen |
| Domain | download-file.today | High | Score 63/100 | First seen |
| URL | https://staticcloudflare.pro/api/css.js | High | Score 63/100 | First seen |
| URL | https://com-apps.cc/update.zip | High | Score 63/100 | First seen |
| MD5 | f280e12f51f996dae7fffc64a56ee527 | High | Score 56/100 | First seen |
| URL | https://cloud-verification.com/update.zip | High | Score 63/100 | First seen |
| Domain | web-telegram.ug | High | Score 72/100 | First seen |
| MD5 | fceca579efcef09eb507c6ca977ea281 | High | Score 71/100 | First seen |
| Domain | com-app.cc | High | Score 58/100 | First seen |
| MD5 | 18a7251ddde77ed24bc54700d84d9be1 | High | Score 56/100 | First seen |
| URL | https://clo4shara.xyz/11z77u3.php | High | Score 64/100 | First seen |
| URL | https://com-apps.cc/11z77u3.php | High | Score 63/100 | First seen |
| Domain | script-dev.buzz | High | Score 86/100 | First seen |
| MD5 | ec5dfee13abf94e08d0f94e90b527db0 | High | Score 56/100 | First seen |
| MD5 | d30cc10d54ebc967c8538ff74f442eee | High | Score 80/100 | First seen |
| Domain | static-file.digital | High | Score 63/100 | First seen |
| URL | https://taketwolabs.com/wp-content/NotepadPlusPlus.dll | High | Score 63/100 | First seen |
| URL | https://cloud-verification.com | High | Score 63/100 | First seen |
| Domain | cloud-verificatoin.com | High | Score 58/100 | First seen |
| Domain | updatesecurity.pro | High | Score 81/100 | First seen |
| URL | https://script-dev.digital/api/css.js | High | Score 63/100 | First seen |
| MD5 | 5659292833ec421da11ebde005d9c9a8 | High | Score 56/100 | First seen |
| CVE | CVE-2026-26980 | High | Score 64/100 | First seen |
| Domain | script-dev.xyz | High | Score 63/100 | First seen |
IOC Relationship Graph
Building graph…