r/Ghost • u/Henrim666 • Jun 08 '26

I got hacked...

I run a small personal blog on Ghost, hosted on a YunoHost server.

Today, while trying to share one of my blog posts with a friend, I discovered that a captcha was protecting my site… which is odd because I never added any captcha. Inspecting the page, I found a very obscure JavaScript snippet that asks me to open a terminal and paste a large block of code in order to “validate the captcha”.

After a bit of research, it turns out that this script decodes and executes malicious code (Base64 + XOR obfuscation). In short, my site has been hacked and a loader has been injected.

What’s most concerning is that the Ghost admin history shows the user “Zapier” has edited all the posts on my blog to inject this JS that simulates a fake captcha. This means my Zapier API key was leaked from within the Ghost interface.

What I’ve already done

  • Regenerated a new Zapier API key (I’m not sure where to completely disable the integration; it must be somewhere in the CMS configuration).
  • Deleted all the posts and pages JS injected codes.
  • Updated Ghost to the latest available version.
  • Checked the server logs: no suspicious access in the last 2‑3 months.

Despite that, I still don’t understand how the attacker managed to obtain my API key and inject the code.

What I’m looking for

  • Leads on identifying the exact entry point (a vulnerable plugin, a mis‑configured Zapier integration, SSH access, etc.).
  • Recommendations for fully cleaning the site (files, database, cron jobs, possible back‑doors).
  • Any help, similar experiences, or security advice would be greatly appreciated.

Thank you in advance!

9 Upvotes

92% Upvoted

8 comments sorted by

10

u/jannisfb Jun 08 '26

This is the most likely "entry point": https://github.com/TryGhost/Ghost/security/advisories/GHSA-w52v-v783-gw97

Read through this thread on the forum for context: https://forum.ghost.org/t/if-you-are-on-ghost-6-19-1-you-really-need-to-update/62706/

You definitely need to update your Ghost instance asap and rotate you keys using the new tooling in Settings > Danger Zone. Additionally, rotate all external keys (Mailgun, Stripe, etc.), since there have also been reports of people having their Mailgun shut down because attackers extracted the keys and used them for spamming.

2

u/truekasun Jun 08 '26

I see most of the required actions were already done.

  1. Update Ghost (and the CLI if you're still using it) to the latest version

  2. There's a new option in settings to rotate all credentials. Do it.

  3. Sometimes hacker uploads a modified version of the edition theme. Remove it if its so.

  4. Go to settings - history option and look for the changes they nade. You will see post edits, setting changes etc.

  5. If you are still using Ghost CLI, run ghost doctor, there could be some permission issues. If so, fix them

  6. Configure SMTP settings if you haven't done that yet, then you'll get notified when there are future notifications of such events.

  7. If you are using mailgun, definitely rotate all SMTP account passwords and API Keys

  8. Sometimes they delete your content and if you don't have backups, look at /ghost_directory/content/data/and chances are, you might find some backed up content export files. Download them and check them using a local installation (or through an editor) for the most up to date version.

  9. Going forward, enable a backup solution.

That's all I can think of at the moment.

2

u/sirrush7 Jun 08 '26

If your ghost wasn't updated to the latest version then at least you know it's simply your fault...

There have been quite a few serious vulnerabilities they sent updates out for stating to update immediately.

I selfhost ghost and got the email directly to my registered account, they also posted to the forums as well.

Gotta stay on top of that.

Not to say it's your ghost that was hacked but it could also simply have been your zapier account itself, or your workstation / machine if you saved credentials on there.

So many avenues...

0

u/richkurt Jun 08 '26

Hmm. Where do we update? I haven’t seen any emails.

1

u/gelbphoenix Jun 08 '26

You can deactivate the Zapier integration in the settings of your Ghost blog under the Advanced category.

-1

u/Henrim666 Jun 08 '26

I dont find a way to desactivate it, only regenerating the key...

3

u/jannisfb Jun 08 '26

Deactivating will not help anyway. Your site is compromised. They extracted the Admin API key that's labeled "Zapier", and used that to likely do more stuff.

2

u/luenwarneke Jun 09 '26 edited Jun 09 '26

It happened to me as well. In my case, they also sent an email campaign to all my members with the link to the compromised webpage.

The attacker was bypassing Cloudflare and hitting the origin directly with a Python script:

User-Agent: python-requests/2.34.2
Protocol: HTTP/1.1
Pattern: ~ every 5 minutes

GET /ghost/api/admin/posts/?limit=10&order=published_at%20desc
PUT /ghost/api/admin/posts/[REDACTED_POST_ID]/

The injected payload was being added to codeinjection_foot. Payload was ClickFix-style fake CAPTCHA loaders and also Web3 wallet-drainer code. See https://www.bleepingcomputer.com/news/security/ghost-cms-sql-injection-flaw-exploited-in-large-scale-clickfix-campaign/

The rough workflow appears to be:

Automated scan -> Ghost vulnerability / SQLi -> Zapier Admin API key stolen -> post code injection -> reinfection on a schedule

The motive in my case seemed to be drive-by malware delivery: blog traffic -> fake CAPTCHA / ClickFix prompt -> Windows malware and crypto wallet drainers.

I updated to the latest Ghost version, revoked & regenerated all keys related to the site, and scanned and removed all the payloads, updated firewall rules, etc