📑 Table of Contents
Large-Scale Campaign Targeting Website Content Management Systems
The Australian Cyber Security Centre has issued an advisory warning of a global campaign exploiting vulnerabilities in WordPress, Joomla, Drupal and Ghost CMS to deploy webshells and distribute malware to website visitors. Many Australian small and medium businesses have already been impacted.
At a Glance
On 9 July 2026, the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) published an advisory confirming that a large-scale, automated global campaign is compromising websites built on popular content management system (CMS) platforms. Attackers are exploiting known, patched vulnerabilities to plant webshells — hidden backdoors that give them remote control over the web server.
The platforms affected include WordPress, Joomla, Drupal, and Ghost CMS, along with a wide range of third-party plugins and extensions. Many small and medium-sized Australian businesses have already been impacted.
Every vulnerability being exploited in this campaign has a patch available. The organisations being compromised simply have not applied them yet.
Compromised websites are being used to steal visitor credentials, distribute malware, host phishing pages, and serve as a launchpad for deeper attacks into corporate networks. The campaign is closely linked to the ClickFix social engineering technique, which uses fake CAPTCHA prompts to trick website visitors into running malware on their own devices.
Key action: If your organisation runs any website on WordPress, Joomla, Drupal, or Ghost CMS, treat it as potentially compromised until you have confirmed otherwise. Patch immediately, inspect for webshells, and review access logs.
How the Attack Works
The campaign exploits four classes of vulnerability commonly found in CMS platforms and their plugins:
The attack follows a consistent pattern. Automated scanners — increasingly enhanced by artificial intelligence — sweep the internet for websites running outdated CMS software. When a vulnerable site is found, the attacker sends a crafted request that uploads a webshell, typically a small PHP file, into a writable directory on the server. Once deployed, the attacker accesses it through a web browser and can issue commands to the server as though they were sitting at the keyboard.
The speed of exploitation is striking. In the Ghost CMS campaign, security researchers found the attackers’ malware loader was compiled on the same day the patch was announced. In the Joomla PageBuilder CK campaign, exploitation began within hours of the fix being released. The Five Eyes joint statement released on 22 June 2026 warned that AI is collapsing the window between vulnerability disclosure and mass exploitation — this campaign is the live proof.
What Attackers Do After Gaining Access
According to the ACSC advisory, malicious actors leverage compromised web servers for multiple purposes:
- Defacing websites and disrupting normal business operations.
- Capturing credentials entered by site visitors, including usernames, passwords, and payment details.
- Hosting and distributing malware to anyone who visits the site, turning a trusted business website into an attack vector against its own customers.
- Lateral movement — using the compromised server as a covert pathway into the organisation’s broader corporate network.
- Creating hidden administrator accounts and installing persistent backdoors that survive a simple patch or CMS update.
- On shared hosting, scanning for and compromising every other website hosted on the same server by reading database credentials from each site’s configuration files.
Critical point: Patching a vulnerability closes the entry point, but it does not remove a webshell, hidden admin account, or injected script that an attacker has already installed. If your site was compromised before you patched, you must also clean up the persistence. Patching alone is not enough.
Specific Vulnerabilities Being Exploited
Dozens of CVEs are being actively exploited across the CMS ecosystem. The most prominent in this campaign are detailed below.
Joomla Extensions (June–July 2026)
Joomla has been hit particularly hard. A wave of critical vulnerabilities in widely used extensions all share the same root cause: AJAX endpoints that validate a CSRF token but never check whether the caller is actually an authenticated, authorised user. Because Joomla prints the session token into every public page, an attacker can harvest it from the homepage and call the endpoint as an anonymous visitor.
JCE (Joomla Content Editor)
Unauthenticated editor-profile creation allowing PHP file upload and webshell deployment. JCE is the single most-installed Joomla editor. Public exploit code appeared on GitHub on 9 June; CISA added it to the Known Exploited Vulnerabilities catalog on 16 June.
SP Page Builder
Unauthenticated file upload via the custom icon upload endpoint. Exploited as a zero-day before the patch was available. Post-exploitation activity includes creation of hidden Super Administrator accounts using @secure.local email addresses and deployment of persistent PHP file-manager backdoors.
PageBuilder CK
Unauthenticated file upload leading to remote code execution. Exploited within hours of the patch being released on 27 June 2026. The destination folder and filename (including extension) were taken directly from the request with no allow-list, no block on PHP files, and no confinement to a media directory.
iCagenda
The frontend event submission form accepted file attachments without sufficient server-side checks on file type, allowing a PHP webshell to be uploaded and executed from a web-accessible directory.
Astroid Framework
The AJAX handler validated the CSRF token but never checked the request came from an authenticated admin. Attackers grabbed the token from the public login page and uploaded backdoors.
Novarain / Tassos Framework
No permission check at all. Joomla’s com_ajax routed requests to the plugin, which whitelisted file inclusion as a non-admin task, allowing arbitrary PHP file inclusion, file deletion, and SQL injection. A hidden dependency bundled with Convert Forms, EngageBox, and other popular extensions.
Ghost CMS (CVE-2026-26980)
A critical SQL injection vulnerability (CVSS 9.4) in Ghost CMS versions 3.24.0 through 6.19.0 has been exploited at massive scale. Attackers extract the site’s Admin API key without authentication, then use the Ghost Admin API to inject malicious JavaScript into articles across the entire site.
Over 700 websites were confirmed compromised, including those belonging to Harvard University, Oxford University, Auburn University, and DuckDuckGo. The vulnerability was patched in version 6.19.1 on 19 February 2026. QiAnXin XLab, the Chinese security research team that documented the campaign, described it as a five-stage automated chain: CMS takeover, page poisoning, two-stage loading, social engineering lure, and malware delivery.
Critically, researchers found at least two rival threat groups competing for the same compromised sites, sometimes overwriting each other’s payloads within a single day. Updating Ghost to the patched version closes the vulnerability but does not remove injections already stored in the site content — fixing a compromised site means patching, cleaning all content, and rotating the Admin API key.
WordPress Plugins
WordPress remains the most targeted CMS due to its vast plugin ecosystem. Actively exploited plugins in this campaign include Simple File List, WavePlayer, BerqWP, WPBookit, Ninja Forms, ThemeREX Addons, Breeze Cache, ACF Extended, WPvivid Backup, and Gravity Forms, among others. Compromised WordPress sites are being used extensively to distribute malware through fake CAPTCHA prompts targeting the site’s visitors.
Known Threat Actors
The 0xTeam-Network collective has been running a massive automated exploitation campaign specifically targeting Joomla portals, injecting PHP webshells and control files into the directory structures of corporate, educational, and government web servers across more than 20 countries including Australia, France, Germany, Italy, Brazil, Colombia, Indonesia, and Russia.
Separately, in early July 2026, multiple Joomla sites were defaced with a “Hacked by Antonkill” claim page, linked by CERT researchers to the same wave of unauthenticated Joomla extension flaws.
The ClickFix Threat: Fake CAPTCHAs Distributing Malware
This CMS campaign is closely linked to a social engineering technique called ClickFix that the ACSC has been warning about since early 2026. Once attackers compromise a CMS-based website, they inject JavaScript that presents visitors with a fake Cloudflare or CAPTCHA verification prompt — the kind of “verify you are human” check people encounter routinely when browsing the web.
Instead of performing a genuine verification, the fake prompt silently copies a malicious command to the visitor’s clipboard, then instructs them to paste it into the Windows Run dialogue (Win+R) or PowerShell. If the visitor follows the instructions, they unknowingly install malware — typically an information stealer capable of harvesting passwords, browser data, session tokens, banking credentials, and cryptocurrency wallets.
No legitimate website, CAPTCHA, or verification check will ever ask you to open a command prompt, press Win+R, or paste commands into PowerShell or Terminal. If a website asks you to do this, close the page immediately. Do not follow the instructions under any circumstances.
Why ClickFix Is So Dangerous
ClickFix is particularly effective because the victim runs the command themselves, with their own user permissions, inside a Microsoft-signed binary. This means many traditional security tools — email filters, browser protections, and endpoint detection — do not intervene until after the damage is done.
Microsoft’s 2025 Digital Defense Report identified ClickFix as the single most common initial access method, responsible for 47% of all attacks observed by Microsoft Defender Experts — ahead of traditional phishing at 35%. ESET separately measured a 517% surge in ClickFix detections in the first half of 2025.
Malware families distributed via ClickFix include Vidar Stealer, Lumma Stealer, DanaBot, AsyncRAT, SectopRAT, Rhadamanthys, NetSupport RAT, Latrodectus, XWorm, and on macOS, AMOS/Atomic Stealer. The technique has been adopted by state-sponsored groups linked to Russia (APT28), North Korea (Kimsuky), and Iran (MuddyWater).
Stolen session cookies are a particular concern — they allow attackers to bypass both passwords and active multi-factor authentication by hijacking an already-authenticated session.
ClickFix Targeting Australian Infrastructure
In a separate advisory published in May 2026, the ACSC specifically warned that compromised Australian WordPress sites were being used to distribute Vidar Stealer malware against Australian organisations and infrastructure using ClickFix prompts. Researchers identified more than 250 infected websites across at least 12 countries, including Australia, and the ACSC confirmed that attacks had been observed targeting multiple Australian sectors.
Vidar Stealer, a malware-as-a-service infostealer active since 2018, harvests browser passwords, cookies, autofill data, MFA tokens, and cryptocurrency wallets. It self-deletes its executable after launching and operates primarily in memory, reducing forensic traces. Its command-and-control infrastructure is retrieved via dead-drop URLs hosted on legitimate services such as Telegram bots and Steam profiles.
Does This Affect Websites Not Built on WordPress or a CMS?
If your website is a static HTML site, a custom-coded application, or is hosted on a managed or serverless platform, you are not directly vulnerable to this particular campaign.
The entire attack chain depends on exploiting vulnerabilities in CMS software and its plugin ecosystem — specifically, the ability to upload files to writable directories on a traditional web server. Static HTML websites and modern serverless architectures do not have writable server filesystems, do not run PHP, and do not have plugin ecosystems that can be exploited.
Who Is and Isn’t at Risk
No website is immune to all cyber threats. The sites marked “No” above are not vulnerable to the CMS webshell attack described in this advisory, but other risks such as compromised credentials, misconfigured hosting, supply-chain attacks on JavaScript dependencies, or social engineering still apply.
Everyone Is Still at Risk as a Visitor
Even if your own website is not built on a CMS, this campaign affects anyone who uses the internet. Anyone who visits a compromised website can be targeted by the ClickFix malware distribution technique. A legitimate Australian business website that has been silently compromised can serve malware to every visitor, steal credentials entered on the site, or redirect visitors to phishing pages — regardless of what technology your own website uses.
ACSC Recommended Actions
If You May Be Compromised (Detection and Response)
The ACSC recommends the following steps for website owners who suspect their CMS may have been targeted:
- Inspect your CMS for webshells. Examine web directories for abnormal or recently changed files, particularly in plugin directories. Look for unexpected
.phpfiles in/tmp,/media,/images,/cacheand plugin folders. - Examine web access logs for any IP addresses making GET or POST requests to unusual file paths, particularly paths that match common webshell locations.
- Check for rogue administrator accounts — particularly accounts using
@secure.localemail addresses, accounts with machine-generated usernames, or accounts you do not recognise. - Look back in time to trace suspicious web requests that may make up the initial exploitation and deployment of any webshells.
- Review network logs (such as on edge firewalls) for interactions with any of the identified malicious IP addresses.
- Treat any server with a confirmed webshell as fully compromised. Isolate it, perform an audit of authentication and network logging for malicious events and connections, and investigate for evidence of persistence, lateral movement, or other malicious actions.
If Webshells or Malware Are Found
- Patch vulnerable systems to prevent re-infection.
- Remove or quarantine identified webshells and malware.
- Remove any persistence mechanisms and ensure the device is safe before bringing it back online.
- Restore websites from a recent known-good backup — do not rely on patching and cleanup alone.
- Rotate all credentials — CMS admin passwords, database credentials, FTP credentials, and API keys.
Protecting Your Websites
The ACSC encourages organisations to take the following proactive steps:
- Ensure website software and plugins are up to date. All vulnerabilities exploited in this campaign are public and known, with patches available. Consider applying all security patches automatically if the risk of a faulty patch is acceptably low or can be rolled back easily.
- Disable or remove plugins that have an actively exploited vulnerability, until a patch or other mitigation is available and applied.
- Consider managed cloud-hosted platforms where the provider is responsible for rapidly remediating vulnerabilities on your behalf.
- Monitor or block file creation. Where possible, web directories should be configured as read-only to prevent webshell deployment. If blocking file creation is not feasible, establish a formal change process and monitor for any file creation outside of approved activities.
- Restrict file and path access. Define which files and directories can be accessed, and explicitly identify those that are restricted.
- Monitor for unexpected child processes. Webshells are used to run commands on the compromised system, and these child processes spawn off the web server process. Prevent or closely monitor unexpected child processes to detect and limit malicious activity.
- Limit broader network compromise by restricting communication between internet-facing websites and other corporate devices.
- If a service provider maintains your website, forward them the ACSC advisory and ask them to confirm the above steps have been taken.
For All Internet Users
The single most important thing to remember:
No legitimate website will ever ask you to paste commands into a system window. If you are asked to press Win+R, open PowerShell or Terminal, or paste text from a website, it is an attack. Close the page immediately.
- Be cautious when browsing, even on websites you recognise and trust. A legitimate site can be silently compromised.
- Keep all devices up to date with the latest security patches.
- Use strong, unique passwords with multi-factor authentication on all accounts.
- If you believe you may have executed an unfamiliar command, treat it as a potential compromise: disconnect from the network, change your passwords from a different device, and seek professional advice or report to cyber.gov.au.
The Bigger Picture: AI Is Accelerating These Attacks
The ACSC advisory explicitly references the Five Eyes joint statement released on 22 June 2026, in which the heads of all five allied cyber security agencies — Australia, Canada, New Zealand, the United Kingdom, and the United States — warned that artificial intelligence is transforming cyber risk at a pace measured in months, not years.
The statement warned that frontier AI models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities. AI lowers the barriers for malicious actors, increases the speed and complexity of attacks, and shrinks the window between vulnerability discovery and exploitation.
This CMS campaign is a live illustration of that warning. AI-enhanced scanning tools are enabling attackers to find and exploit vulnerable websites at a speed and scale that was not possible even a year ago. The Five Eyes agencies urged leaders to treat cyber resilience as a core business responsibility, accelerate patching, retire unsupported systems, and prepare for incidents on the assumption that breaches will occur. Those who delay, they warned, will face growing and avoidable risk.
Common Questions
What is a webshell?
A webshell is a small malicious script (usually a PHP file) that an attacker uploads to a web server. Once in place, it acts as a hidden backdoor — the attacker can access it through a web browser and remotely run commands on the server, browse files, steal data, create new administrator accounts, or install further malware. Webshells are designed to blend in with legitimate files and can be very difficult to spot without deliberate inspection.
What is a CMS?
A content management system (CMS) is software used to build and manage websites without needing to write code from scratch. WordPress, Joomla, Drupal, and Ghost are among the most widely used. They rely on plugins and extensions to add functionality, and it is often these plugins that contain the vulnerabilities attackers exploit.
My website runs on WordPress. Does that mean it has been hacked?
Not necessarily — but it means your site could be vulnerable if your WordPress core, plugins, or themes are not fully up to date. You should patch everything immediately, inspect your site for unfamiliar files (particularly .php files in upload, media, or plugin directories), check for any administrator accounts you do not recognise, and review your access logs for suspicious activity.
My website is built in plain HTML or hosted on Squarespace, Wix, or Shopify. Am I affected?
Your website is not vulnerable to this specific campaign. The attack depends on exploiting CMS software and plugins running on a traditional web server with writable directories. Static HTML sites and managed platforms do not have this attack surface. However, you are still at risk as a visitor to compromised websites — see the ClickFix section above.
My website is built on a serverless platform like Vercel or Netlify. Am I at risk?
No. Serverless and JAMstack platforms do not have persistent, writable server filesystems or PHP execution environments. There is no directory for an attacker to upload a webshell to. This campaign does not affect these architectures.
What is ClickFix and how does it affect me even if I do not own a website?
ClickFix is a social engineering technique where a compromised website displays a fake “verify you are human” prompt. Instead of a genuine CAPTCHA check, it tricks the visitor into copying a malicious command and pasting it into a Windows system window (Run, PowerShell, or Terminal). If the visitor follows the instructions, malware is installed that can steal passwords, browser data, banking credentials, and session tokens. Anyone browsing the internet can encounter this on a compromised site — even a site that was previously legitimate and trusted.
How do I know if a CAPTCHA prompt is fake?
A real CAPTCHA or Cloudflare verification will only ever ask you to click a checkbox, select images, or solve a simple puzzle — all within the browser window. It will never ask you to press Win+R, open PowerShell or Terminal, or paste anything into a command window. If a verification prompt gives you these instructions, it is malicious. Close the browser tab immediately.
I think I may have followed a fake CAPTCHA prompt. What should I do?
Treat it as a potential compromise. Disconnect the device from the internet immediately. Do not log in to any accounts on that device. Change your important passwords (email, banking, work accounts) from a different device. Run a full scan with up-to-date antivirus software. If you entered credentials on the affected device after the incident, assume those credentials are compromised. You can report the incident at cyber.gov.au/report or call 1300 CYBER1 (1300 292 371).
I patched my CMS. Am I safe now?
Patching closes the door, but it does not remove anything an attacker already installed. If your site was compromised before you patched, the webshell, hidden admin accounts, injected scripts, and any other persistence mechanisms will still be there. You need to inspect the site, remove any malicious files and accounts, rotate all credentials (CMS admin, database, FTP, API keys), and ideally restore from a known-good backup taken before the compromise occurred.
I use a web developer or hosting provider to manage my site. What should I do?
Forward the ACSC advisory to them and ask them to confirm your CMS and all plugins are fully patched, that no webshells or unauthorised files have been found, and that web directories are configured as read-only where possible. If they cannot confirm these steps, escalate it.
Are Australian Government websites affected?
The ACSC advisory is directed at all organisations, but Australian Government websites that follow the Protective Security Policy Framework (PSPF) and implement the ASD’s Essential Eight should have mitigations in place. The campaign has primarily impacted small and medium-sized businesses with self-hosted CMS installations that have not been kept up to date.
Where can I get help?
If you believe your website or devices have been compromised, you can report to the ACSC via cyber.gov.au/report or call the Australian Cyber Security Hotline on 1300 292 371 (1300 CYBER1), available 24/7.
Citations
This article was compiled from the following sources. All information has been verified against the primary ACSC advisory and supporting security research.
- Australian Signals Directorate — ACSC. Large-scale exploitation campaign targeting website content management systems (CMS). 9 July 2026. cyber.gov.au
- Australian Signals Directorate — ACSC. ClickFix distributing Vidar Stealer via WordPress targeting Australian infrastructure. May 2026. cyber.gov.au
- Australian Signals Directorate — ACSC. Five Eyes cyber security agencies statement. 22 June 2026. cyber.gov.au
- GBHackers. Attackers Exploit WordPress Plugin Vulnerabilities for Remote Code Execution and Webshell Access. 10 July 2026. gbhackers.com
- Cyberpress. Hackers Scan CMS Websites Globally to Deploy Webshells and Steal Credentials. 10 July 2026. cyberpress.org
- The Hacker News. Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks. May 2026. thehackernews.com
- The Hacker News. CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV. July 2026. thehackernews.com
- mySites.guru. PageBuilder CK RCE — CVE-2026-56290. July 2026. mysites.guru
- Malwarebytes. 700+ education and tech websites hijacked in huge ClickFix malware campaign. May 2026. malwarebytes.com
- Bitdefender. ClickFix Campaign Uses Compromised WordPress Sites to Spread Vidar Stealer in Australia. May 2026. bitdefender.com
- iTnews. ‘ClickFix’ attack tricks users into hacking themselves, ACSC warns. May 2026. itnews.com.au
- CERT Cyberoo. Defacement “Hacked by Antonkill”: what the attack on Joomla sites tells us. July 2026. cert.cyberoo.com
- Vulert. Joomla JCE CVE-2026-48907 Exploited — Patch Now. June 2026. vulert.com
- Microsoft Security Blog. Think before you Click(Fix): Analyzing the ClickFix social engineering technique. 2025 (updated 2026). microsoft.com
Resources & Contact
Primary Advisory
Website: Large-Scale CMS Exploitation Campaign — cyber.gov.au
Related Advisories
ClickFix Distributing Vidar Stealer via WordPress — cyber.gov.au
Five Eyes Cyber Security Agencies Statement — cyber.gov.au
Protect Yourself — cyber.gov.au
Report a Cyber Incident
Online: cyber.gov.au/report
24/7 Hotline: 1300 CYBER1 (1300 292 371)
AusClear Enquiries
Email: support@ausclear.com.au
Phone: 1300 027 423
Monday – Friday, 9:00 AM – 5:00 PM (Adelaide time)
Was this article helpful?