Dossier
ClickFix Attacks
Coverage of ClickFix Attacks in the Nexus archive.
- Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks
Threat actors are exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS to inject malicious JavaScript into over 700 websites for ClickFix attacks. QiAnXin XLab reported the exploit, which leverages an unauthenticated API flaw with a CVSS score of 9.4 to exfiltrate data and deploy malware.
- Venom Stealer MaaS Platform Commoditizes ClickFix Attacks
A new MaaS platform called Venom Stealer enables automated, persistent information-stealing attacks through social engineering. The service commoditizes ClickFix attacks, making them easier to execute on the cybercrime market.