# Threat Intel Brief — May 26, 2026

TL;DR

  • Critical Ghost CMS exploitation: Threat actors are mass-exploiting CVE-2026-26980, a SQL injection vulnerability in Ghost CMS, to compromise over 700 websites and distribute ClickFix social engineering attacks.
  • Cross-ecosystem supply chain attack: The TrapDoor campaign has poisoned 34+ malicious packages across npm, PyPI, and Crates.io repositories, targeting developer credentials across JavaScript, Python, and Rust ecosystems.
  • North Korean financial targeting: Lazarus Group deployed RemotePE, a memory-only cross-platform RAT, against financial institutions and cryptocurrency platforms in continued sanctions-evasion operations.
  • Russian infrastructure disrupted: Dutch authorities arrested two hosting company operators and seized infrastructure used by Russia for cyberattacks and disinformation campaigns targeting the EU.
  • Microsoft 365 phishing service: The FBI warned of Kali365, a phishing-as-a-service platform exploiting OAuth device code flows to bypass multi-factor authentication and hijack corporate accounts.

Critical Threats

Ghost CMS Mass Exploitation (CVE-2026-26980)

What happened: Threat actors are actively exploiting CVE-2026-26980, a critical SQL injection vulnerability (CVSS 9.4) in the Ghost CMS Content API. The unauthenticated vulnerability allows attackers to read arbitrary database contents and inject malicious JavaScript into compromised sites. Over 700 websites have been confirmed compromised, with injected code delivering ClickFix social engineering attacks that trick visitors into executing malicious commands.

Impact: Organizations running Ghost CMS face immediate risk of database compromise, credential theft, and reputational damage. Compromised sites serve as watering holes, exposing visitors to ClickFix attacks that leverage fake error messages to deceive users into running attacker-controlled PowerShell or command-line payloads. The scale of exploitation indicates automated tooling and coordinated infrastructure.

Recommendations:

  • Immediately patch all Ghost CMS instances to the latest version addressing CVE-2026-26980
  • Audit database logs for suspicious SQL queries since May 2026
  • Inspect all Ghost content for injected JavaScript in posts, pages, and theme files
  • Deploy web application firewall rules to block SQL injection patterns targeting Ghost Content API endpoints
  • Monitor for ClickFix indicators: fake error dialogs, clipboard manipulation scripts, and prompts requesting command execution

TrapDoor Supply Chain Campaign

What happened: A coordinated supply chain attack named TrapDoor has distributed credential-stealing malware across npm, PyPI, and Crates.io package repositories since May 2026. The campaign spans 34+ malicious packages with 384+ versions, targeting JavaScript, Python, and Rust developer communities simultaneously. The cross-ecosystem approach demonstrates sophisticated understanding of software supply chains and developer workflows.

Impact: Developers installing affected packages expose credentials, API keys, and session tokens to attackers. Compromised developer workstations and CI/CD pipelines create pathways for source code theft, supply chain poisoning of internal applications, and lateral movement into production environments. The multi-repository scope suggests a well-resourced threat actor seeking widespread credential collection for downstream operations.

Recommendations:

  • Audit package dependencies in package.json, requirements.txt, and Cargo.toml for unfamiliar packages added since May 2026
  • Review package manager and CI/CD build logs for installations of identified malicious packages
  • Rotate all credentials, API keys, and tokens on potentially affected developer systems and build servers
  • Implement package signature verification and enable dependency scanning tools (npm audit, pip-audit, cargo-audit) in CI/CD pipelines
  • Monitor developer systems for unusual outbound connections to unknown infrastructure

Lazarus Group Financial Sector Targeting

What happened: North Korean state-sponsored group Lazarus deployed RemotePE, a cross-platform memory-only remote access trojan, in targeted attacks against financial institutions and cryptocurrency organizations. The malware operates entirely in memory to evade disk-based detection, delivered through a multi-stage loader chain involving DPAPILoader and RemotePELoader. NCC Group's Fox-IT documented the campaign.

Impact: Financial services and cryptocurrency platforms face persistent threat from a well-resourced state actor motivated by sanctions evasion and revenue generation. The memory-resident architecture minimizes forensic artifacts and evades traditional endpoint protection. Successful compromise could enable SWIFT network access, cryptocurrency theft, or long-term espionage operations supporting North Korean regime priorities.

Recommendations:

  • Monitor for unusual process injection activity, particularly from Office applications or browsers injecting into system processes
  • Implement memory scanning capabilities to detect reflective code loading and in-memory payloads
  • Baseline DPAPI usage patterns and alert on abnormal credential access or decryption operations
  • Harden cryptocurrency and financial transaction systems with application whitelisting and strict code signing enforcement
  • Deploy network monitoring for anomalous encrypted C2 traffic from financial workstations to previously unseen infrastructure

Threat Actor Activity

Kali365 Phishing-as-a-Service

The FBI issued a public warning about Kali365, a phishing-as-a-service platform enabling cybercriminals to conduct credential harvesting campaigns against Microsoft 365 accounts. The service exploits OAuth device code authentication flows to steal session tokens, bypassing multi-factor authentication protections. By weaponizing legitimate authentication mechanisms, Kali365 lowers the barrier to entry for account takeover operations, allowing low-skill actors to execute sophisticated attacks at scale.

Defensive measures: Organizations should monitor Azure AD sign-in logs for anomalous device code flow authentication events, implement conditional access policies restricting device code authentication to trusted devices, and deploy phishing-resistant MFA methods such as FIDO2 hardware tokens. Enable continuous access evaluation (CAE) in Microsoft 365 to enforce real-time policy changes and revoke sessions when risk conditions are detected.

ClickFix Operators

Threat actors leveraging ClickFix social engineering tactics have weaponized CVE-2026-26980 to compromise over 700 Ghost CMS sites. The operators inject malicious JavaScript that presents fake error messages or prompts, deceiving visitors into executing attacker-controlled commands. The campaign demonstrates automated exploitation tooling and scalable command-and-control infrastructure. ClickFix attacks have evolved from phishing emails to direct CMS exploitation, indicating tactical adaptation by operators seeking mass distribution capabilities.

Geopolitical Context

Dutch Disruption of Russian Cyber Infrastructure

Dutch authorities arrested two co-owners of Internet hosting companies for operating infrastructure used by Russia to conduct cyberattacks, influence operations, and disinformation campaigns within the European Union. The companies had assumed control of technical infrastructure belonging to Stark Industries Solutions, an ISP previously sanctioned by the EU for facilitating Russian intelligence cyber operations. The action included seizure of infrastructure and represents significant European enforcement against commercial enablers of state-aligned cyber activity.

The arrests signal heightened European resolve to disrupt commercial infrastructure supporting Russian operations, particularly following increased hybrid activities since 2022. The case may establish precedent for criminal prosecution of hosting providers who enable state cyber operations, complementing traditional sanctions with individual accountability. Russian actors are likely to adapt by diversifying hosting arrangements and shifting to jurisdictions with weaker enforcement.

North Korean Revenue Generation Operations

Lazarus Group's deployment of RemotePE against financial and cryptocurrency targets aligns with North Korea's sustained strategic focus on cyber-enabled revenue generation to circumvent international sanctions. The use of sophisticated memory-resident tooling demonstrates continued investment in operational security, likely aimed at evading detection while maximizing financial gain. Such operations underscore the regime's reliance on illicit cyber-enabled finance as a critical component of economic survival under multilateral sanctions pressure.

Recommended Actions

Immediate (0-24 hours)

  • Patch Ghost CMS: Update all Ghost CMS instances to versions addressing CVE-2026-26980
  • Audit package dependencies: Review npm, PyPI, and Crates.io dependencies for TrapDoor campaign indicators
  • Rotate credentials: Change credentials on developer systems that may have installed malicious packages since May 2026
  • Review OAuth logs: Check Azure AD sign-in logs for anomalous device code flow authentication events

Short-term (24-72 hours)

  • Deploy WAF rules: Implement web application firewall protections against SQL injection targeting Ghost CMS
  • Enable memory scanning: Activate EDR memory analysis capabilities to detect fileless malware like RemotePE
  • Audit Ghost content: Inspect all Ghost CMS sites for injected JavaScript in posts, pages, and theme files
  • Implement package scanning: Enable dependency scanning tools in CI/CD pipelines (npm audit, pip-audit, cargo-audit)

This week

  • Review MFA implementation: Assess Microsoft 365 MFA configurations and migrate to phishing-resistant methods (FIDO2, certificate-based authentication)
  • Baseline DPAPI usage: Establish normal DPAPI credential access patterns to detect Lazarus loader activity
  • Harden development environments: Restrict package installation to approved internal mirrors or private registries with security vetting
  • Update threat intelligence: Incorporate TrapDoor, Kali365, and RemotePE indicators into SIEM and threat hunting workflows

Watch List

  • OutSystems Lifetime vulnerability: CVE-2026-40127, an authorization bypass through user-controlled key vulnerability in OutSystems Lifetime software, has been disclosed. While exploitation status remains unknown, organizations using OutSystems for application lifecycle management should monitor vendor advisories for patch availability and apply updates promptly. The vulnerability could enable unauthorized access to deployment pipelines and environment configurations.
  • ClickFix evolution: Monitor for continued ClickFix campaign expansion beyond Ghost CMS to other content management systems and web platforms. The technique's effectiveness in social engineering may drive adoption by additional threat actors.
  • Russian infrastructure reconstitution: Following Dutch enforcement action, observe for Russian cyber operations shifting to alternative hosting jurisdictions or employing more sophisticated infrastructure obfuscation techniques.

Sources

  • BleepingComputer: FBI warns of Kali365 phishing service targeting Microsoft 365 accounts — https://www.bleepingcomputer.com/news/security/fbi-warns-of-kali365-phishing-service-targeting-microsoft-365-accounts/
  • BleepingComputer: Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign — https://www.bleepingcomputer.com/news/security/ghost-cms-sql-injection-flaw-exploited-in-large-scale-clickfix-campaign/
  • The Hacker News: Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks — https://thehackernews.com/2026/05/ghost-cms-cve-2026-26980-exploited-to.html
  • The Hacker News: TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO — https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html
  • The Hacker News: Lazarus Deploys RemotePE Memory-Only RAT Against Financial and Crypto Firms — https://thehackernews.com/2026/05/lazarus-deploys-remotepe-memory-only.html
  • Krebs on Security: Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks — https://krebsonsecurity.com/2026/05/netherlands-seizes-800-servers-arrests-2-for-aiding-cyberattacks/
  • CERT.PL: Vulnerability in Lifetime software — https://cert.pl/en/posts/2026/05/CVE-2026-40127/