← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Ghost CMS Mass Compromised via CVE-2026-26980, Now Fueling ClickFix Attacks
WHITE Tr1sa111 2026-05-24 Modified: 2026-05-24
33
IOCs
MEDIUM VOLUME
sql injectioncloakinginstaller.dllnotepadplusplus.dllclickfixghost cmsinformation stealermass compromiseutilifysetup.execve-2026-26980fakecaptcha
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
installer.dll UtilifySetup.exe NotepadPlusPlus.dll
Indicators of Compromise (33)
All FileHash-MD5 URL domain
TYPEINDICATORDESCRIPTIONCREATED
FileHash-MD5 18a7251ddde77ed24bc54700d84d9be1 — 2026-05-24
FileHash-MD5 5659292833ec421da11ebde005d9c9a8 — 2026-05-24
FileHash-MD5 d30cc10d54ebc967c8538ff74f442eee — 2026-05-24
FileHash-MD5 f280e12f51f996dae7fffc64a56ee527 — 2026-05-24
FileHash-MD5 fceca579efcef09eb507c6ca977ea281 — 2026-05-24
URL https://cdnupdatenews.top/dl?fid=38 — 2026-05-24
URL https://clo4shara.xyz/11z77u3.php — 2026-05-24
URL https://cloud-verification.com/update.zip — 2026-05-24
URL https://com-apps.cc/11z77u3.php — 2026-05-24
URL https://com-apps.cc/NotepadPlusPlus.zip 2858eea059aea9789fb32ec31c284c54030114649f29daf78a2a1bd6516092b5 2026-05-24
URL https://com-apps.cc/update.zip — 2026-05-24
URL https://jalwat.com/static/uploads/campaigns/6/update.zip — 2026-05-24
URL https://platecrumbs.com/11z77u3.php — 2026-05-24
URL https://script-dev.digital/api/css.js — 2026-05-24
URL https://staticcloudflare.pro/api/css.js — 2026-05-24
URL https://taketwolabs.com/wp-content/NotepadPlusPlus.dll — 2026-05-24
domain cdnupdatenews.top — 2026-05-24
domain clo4shara.xyz — 2026-05-24
domain cloud-verification.com — 2026-05-24
domain com-apps.cc — 2026-05-24
domain download-file.today — 2026-05-24
domain jalwat.com — 2026-05-24
domain platecrumbs.com — 2026-05-24
domain script-dev.buzz — 2026-05-24
domain script-dev.digital — 2026-05-24
domain script-dev.xyz — 2026-05-24
domain static-file.digital — 2026-05-24
domain staticcloudflare.pro — 2026-05-24
domain taketwolabs.com — 2026-05-24
domain updatefile-cf.top — 2026-05-24
domain updatefilescf.top — 2026-05-24
domain updatesecurity.pro — 2026-05-24
domain web-telegram.ug — 2026-05-24
References (1)
↗ https://blog.xlab.qianxin.com/ghost-cms-mass-compromised-via-cve-2026-26980-now-fueling-clickfix-attacks/