claudio bono - Sicuranext Blog

Sign in Subscribe

claudio bono

Ghost Stories: investigating an undocumented ClickFix C2 in Ghost CMS

Ghost Stories: investigating an undocumented ClickFix C2 in Ghost CMS

Read-only research into an active campaign that exploits CVE-2026-26980 in Ghost CMS. Every result below comes from public GET requests. We did not exploit the flaw, did not authenticate, and did not write anything. The main scan ran on 2026-06-11. Key findings * An active campaign is exploiting CVE-2026-26980, a SQL

One Paste to Rule Them All: Inside a ClickFix → EtherHiding → GULoader Intrusion

One Paste to Rule Them All: Inside a ClickFix → EtherHiding → GULoader Intrusion

A real-world ClickFix intrusion observed from both sandbox and endpoint telemetry, revealing the complete attack path from a compromised WordPress site to a blocked GULoader execution, including a full process creation call stack from the Windows Run dialog to the kernel. Preamble In April 2026, we responded to an endpoint

68% Of Phishing Websites Are Protected by CloudFlare

68% Of Phishing Websites Are Protected by CloudFlare

Earlier this year, our CTI team set out to build something we'd been thinking about for a while: a phishing intelligence pipeline that could actually keep up with the threat. We combined feeds from hundreds of independent sources with our own real-time hunt for suspicious SSL/TLS certificates.

Medical Devices Exposed

Medical Devices Exposed

Medical devices, ranging from pacemakers to infusion pumps, have traditionally been designed with a singular purpose: to improve patient care and outcomes. Yet, as these devices become more interconnected through the Internet of Medical Things (IoMT), the cybersecurity landscape surrounding them has grown increasingly complex. In the Healthcare landscape there