Threat Intelligence / Actor / Multi-cluster (XLab Cluster A + Cluster B)

Multi-cluster (XLab Cluster A + Cluster B)

1 tracked threat(s) · Categories: VULNERABILITY

Also known as: XLab Cluster A, XLab Cluster B, Ghost CMS ClickFix Operators

Tracked threats

Ghost CMS Content API SQL Injection CVE-2026-26980 — Large-Scale ClickFix Watering-Hole Campaign Compromising 700+ Domains (XLab) — CRITICAL

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence