U.S. and Canadian authorities arrested and charged a Canadian man with operating the KimWolf distributed denial-of-service (DDoS) botnet, which infected nearly two million devices worldwide.

23-year-old Jacob Butler (also known online as “Dort”) was arrested by Canadian authorities in Ottawa on Wednesday pursuant to an extradition warrant.

According to a criminal complaint unsealed on Thursday in the District of Alaska, Butler was taken into custody based on IP address and online account information, transaction records, and online messaging records that exposed his links to the KimWolf botnet.

Butler now awaits extradition to the U.S. and is facing one count of aiding and abetting computer intrusions, which carries a maximum sentence of 10 years in prison. 

As detailed in court documents, KimWolf operated as a DDoS-for-hire service and was used by cybercriminals to launch attacks reaching nearly 30 terabits per second, the largest DDoS attack publicly disclosed at the time.

Using a cybercrime-as-a-service model, Butler sold access to a massive network of compromised enslaved systems (ranging from digital photo frames and web cameras to Android-based TV boxes and streaming devices).

The botnet was used in more than 25,000 attacks targeting computers and servers worldwide (including Department of Defense Information Network IP addresses) and caused financial losses exceeding $1 million for some victims.

Researchers at cybersecurity firm Synthient, who have been tracking KimWolf’s rapid expansion, noted in January that KimWolf grew to almost 2 million after compromising Android devices in attacks exploiting vulnerabilities in residential proxy networks, and that it generated approximately 12 million unique IP addresses each week.

Separately, the Central District of California unsealed seizure warrants targeting 45 DDoS-for-hire platforms, which disrupted multiple DDoS platforms, including at least one that collaborated with the KimWolf botnet.

“These seizures broadly disrupted the DDoS platforms, including at least one that collaborated with Butler’s KimWolf botnet,” the Justice Department said yesterday.

“U.S. authorities also seized domain records associated with many of these services, redirecting them to an authorized ‘splash page,’ which displays a warning to potential visitors that DDoS services are illegal.”

Butler’s arrest follows a March 2026 international operation in which U.S., German, and Canadian authorities seized command-and-control infrastructure used by KimWolf and three related botnets (Aisuru, JackSkid, and Mossad), which collectively infected over 3 million IoT devices.

As the U.S. Justice Department said at the time, the four botnets collectively infected more than 3 million IoT devices, including web cameras, digital video recorders, and Wi-Fi routers, many of them in the United States.

Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.

This guide covers the 6 surfaces you actually need to validate.

Download Now

Recently, the biggest trend in kitchen gadgets has been “hands-free” and AI-powered devices that act as automated countertop assistants. There are plenty of devices that exist now for people who want to cook more (or at least look like someone who has their life together) but don’t always have the energy for a full kitchen marathon after work. 

From a robot stirring your soup to a bread machine that kneads your dough while you watch TV, here is a list of gadgets that may make you feel like you’ve won adulthood. Or at least make cooking feel much less intimidating.

The Nosh Chef Robot is a huge upgrade from a slow cooker or Instant Pot, as it can manage much of the cooking process autonomously. 

The AI-powered robot dispenses exact amounts of oils, spices, and ingredients from reusable ingredient cartridges. Users still need to load ingredients beforehand, but once everything is in place, the robot can roughly chop, stir, sauté, portion, plate, and self-clean after meals. However, it can’t bake, roast, or steam, so there are limitations, but the company says it supports more than 500 dishes, such as stir-fry and curry.

The system runs on NoshOS, a proprietary AI trained on thousands of recipes and cooking techniques. Built-in sensors monitor moisture, texture, and browning levels in real time, adjusting heat and seasoning throughout the cooking process. It can even recognize ingredients already loaded into the device and recommend meals based on what’s available.

The Nosh One is currently available for preorder on Kickstarter, with shipments expected in summer 2026.

An automatic soup stirrer sounds unnecessary until you use it once, and suddenly you’re hooked.

Instead of standing over the stove painstakingly stirring soup, sauce, risotto, pudding, or oatmeal, the StirMate Automatic Pot Stirrer rotates around the pot for you while you prep other ingredients, answer emails, or scroll on your phone. 

It could also serve as a helpful accessibility tool for people with mobility issues or chronic pain.

Developed by father-and-son company StirMate, the third-generation model launched recently and includes a stronger motor, adjustable speed settings, and redesigned paddles for thicker recipes. It can run for up to 10 hours on a single charge and recharges in about an hour.

Modern bread machines have evolved far beyond basic sandwich bread. This newer smart model from KitchenArm automates the mixing, kneading, proofing, and baking process, turning homemade bread into a mostly hands-off experience. Just add ingredients, select a setting, and let the machine do the work.

The KitchenArm Smart Bread Machine includes 29 automatic programs with 21 bread settings, including white, French, whole wheat, rye, and sweet breads, plus non-bread options for yogurt, jam, and cake. There’s also a fully customizable “Homemade” mode for adjusting kneading and rising times manually.

Morning routines are significantly easier when your coffee machine remembers your order and the usual time you want to drink it. 

The De’Longhi Rivelia is a newer option and has recently garnered attention for its smart personalization features. In addition to grinding beans, brewing espresso, and frothing milk automatically, the Rivelia supports up to four user profiles, remembers favorite drinks and strength preferences, and adapts recommendations over time based on usage habits. Its “Coffee Routines” feature can even suggest beverages depending on the time of day.

While it’s definitely expensive, it’s widely considered one of the most popular high-end espresso machines currently available. 

Store-bought oat milk prices alone are enough to push some people into making their own. The Nama M1 automates the entire process of making almond, oat, soy, or cashew milk, eliminating the old method of soaking, blending, and then straining that previously made homemade plant milk feel like a full-time job.

Newer nut milk makers have become faster, smarter, and much easier to clean, and the Nama M1 is one of the more widely reviewed examples currently on the market. Using centrifugal force, it can produce creamy plant milk in a few minutes with minimal prep work.

The KitchenArt Auto-Measure Spice Carousel is one of the simplest products on this list, but it solves a very real problem: accidentally dumping half a container of garlic powder into dinner because the spice lid suddenly betrayed you. This rotating carousel stores up to 12 spices and dispenses measured amounts in 1/4 tsp amounts or poured normally through the built-in spouts. 

No apps, no AI, no complicated setup. Just a genuinely practical kitchen tool.

The smart glasses industry has long been a tortured dream of Silicon Valley. The premise is appealing enough: What if, to enjoy the benefits of mobile computing, people didn’t have to stare at their phones all day long and could, instead, simply wear a lightweight computing device on their face? Science fiction fans (a demographic that is strong in the tech industry) can see this vision perfectly.

However, the industry has — for much of the last decade — resembled a financial black hole into which gargantuan investments have been sunk and from which little to no profit has ever emerged.

“Everybody’s losing money,” said Chi Xu, the founder and CEO of the smart glasses company Xreal, which is a longtime partner of Google. I met Xu at Google’s I/O conference in Mountain View last week, where he was promoting Xreal’s Project Aura. That’s its latest effort to create a set of functional XR glasses that people actually want to use.

“That’s because it’s very hard, what we’re doing,” he said.

For much of the industry’s existence, the problems of smart glasses have seemed somewhat obvious: bulky, uncomfortable, and socially awkward form factor, paired with negligibly beneficial software. Now, however, industry insiders — including Xu — feel like their business has turned a corner and may be reaching an inflection point.

That supposed inflection point has something to do with Meta, whose 2023 partnership with Ray-Ban launched one of the first lines of models that has actually managed to sell a lot of units. (It’s worth noting, however, that the division responsible for the glasses, Reality Labs, still operates at a massive loss.)

Now, as form factors shrink and software improves, Xu feels that Xreal can finally become a leader in the space. “You need all the key pieces ready — you need the hardware ready, the operating system needs to be ready, and then you need a great user interface,” Xu said.

Xreal’s newest model Aura is wired smart glasses that have OLED displays embedded within them, meaning that you can watch high-resolution videos within the frames themselves. Somewhat awkwardly, Aura comes tethered to a “puck” — essentially a phone-shaped mini-computer that powers the experience behind the glasses. When using it, you can ostensibly just slip it into your pocket.

But in exchange for the awkwardness of the puck, the user gets a wider variety of fun experiences with the glasses, including an immersive Google Maps app, VR YouTube videos, and a “painting app” that lets you — via the powers of hand tracking — create holographic imagery that only you can see. There are also reportedly games, playable (again) via hand tracking, and basic web surfing functionality.

“Whether you are following a floating recipe while cooking, setting up a private workspace at a coffee shop or on a flight, or watching a movie on a virtual big screen at home, the experience is seamless,” the company promises.

Xu also says that he imagines the device being used not just by the casual consumer but by professionals as well. “It’s not just about watching the NBA game in a hologram type of format, you could also go to a coffee shop and do some work,” he said.

Currently, the glasses are only available for developers, but the plan is for them to launch commercially later this year. Xreal is also working on an IPO that is expected to take place before 2026 is over, although Xu declined to say much about it.

In the meantime, the company is working on that whole turning-a-profit thing. Xu notes that his company has been raising its gross margin while lowering its costs for marketing and sales. “Next year is the year when we could actually break even,” he says.

Save $300 on Apple’s latest 14-inch MacBook Pro with an upgrade to the M5 Pro 18C CPU/20C GPU chip and boost to 48GB RAM. The flash deal ends today.

Apple’s M5 Pro 14-inch MacBook Pro was released in March 2026, but a popular configuration is already marked down heavily during B&H’s flash sale that ends today. Save $300 on this M5 Pro model that has an 18-core CPU with a 20-core GPU, an upgrade from the standard 15-core CPU and 16-core GPU. It also has 48GB of RAM, double that of the standard 24GB found in the entry model. Rounding out the key specs is a 1TB SSD.

Save $300 on 14″ MacBook Pro 48GB RAM

Normally priced at $2,799, the M5 Pro/48GB RAM/1TB spec is discounted to $2,499, reflecting the lowest price seen since its March release. B&H states supply is limited at the reduced price, and the deal ends today at 8:59 p.m. Pacific Time.

This MacBook Pro deal sits alongside several other discounts on the M5 Pro and M5 Max line, so it’s worth checking out highlights from the sale below.

14-inch MacBook Pro M5 Pro and M5 Max sale

• M5 Pro, 15C CPU, 16C GPU, 24GB, 1TB, Standard Display: $1,999 ($200 off)
• M5 Pro, 15C CPU, 16C GPU, 48GB, 1TB, Standard Display: $2,299 ($300 off)
• M5 Pro, 18C CPU, 20C GPU, 48GB, 1TB, Standard Display: $2,499 ($300 off)
• M5 Pro, 18C CPU, 20C GPU, 64GB, 1TB, Standard Display: $2,699 ($300 off)
• M5 Max, 18C CPU, 40C GPU, 64GB, 2TB, Standard Display, Silver: $3,999 ($300 off)

16-inch MacBook Pro M5 Pro and M5 Max deals

• M5 Pro, 18C CPU, 20C GPU, 48GB, 2TB, Standard Display, Space Black: $3,099 ($400 off)
• M5 Max, 18C CPU, 40C GPU, 64GB, 2TB, Standard Display: $4,199 ($400 off)
• M5 Max, 18C CPU, 40C GPU, 128GB, 2TB, Standard Display: $4,999 ($400 off)

You can also compare prices and score deals across every configuration in our 14-inch MacBook Pro M5 Pro/M5 Max Price Guide and 16-inch MacBook Pro M5 Pro/M5 Max Price Guide.

Apple designed this laptop to accomplish everyday tasks without attracting attention to itself. The 13.6-inch MacBook Air M5, priced at $899.99 (was $1,100), weighs only 2.7 pounds and is 0.44 inches thick, allowing it to be easily stored in a backpack or tote until needed. Aluminum feels robust but light in the touch, and the color options offer enough variety without confounding decisions.

Screen real estate works exceptionally well for viewing documents, videos, or simply browsing the web. The 2560-by-1664 Liquid Retina display is a decent size at 13.6 inches diagonally and delivers crisp, clear text along with authentic colors at 500 nits of brightness, as it stays nice and clear even in a normal room light, and that 60-hertz refresh rate just keeps scrolling along smoothly even during those long work sessions, the real drama here is that the panel just shows the content like the creators meant it to.

Sale

Apple 2026 MacBook Air 13-inch Laptop with M5 chip: Built for AI, 13.6-inch Liquid Retina Display, 16GB…

• MIGHT TAKES FLIGHT — MacBook Air with the M5 chip packs blazing speed and powerful AI capabilities into an incredibly portable design. With Apple…
• SUPERCHARGED BY M5 — With its faster CPU and unified memory, the M5 chip delivers even more performance and fluidity across apps, making…
• APPLE INTELLIGENCE — Apple Intelligence is the personal intelligence system that helps you write, express yourself, and get things done…

The M5 processor provides performance by combining a 10-core CPU with an 8-core or 10-core GPU and a 16-core Neural Engine, and this base model includes 16GB of unified memory and 512GB of storage, which is a slight boost over previous generations. Tasks such as photo editing, multi-tab browsing, and light video processing run smoothly. There is no fan, so it stays entirely silent even throughout those long sessions, and that’s primarily due to how effectively the chip balances power and efficiency.

Battery life lasts for days, with 15 to 18 hours of mixed use from a single charge, more than enough to carry you through a full workday and then some. When the battery goes low, the rapid charge will get you back up and running in no time. All of this adds up to fewer anxieties about being tethered to a plug and being free to go on to other sites without bothering about finding a socket.

Connectivity is rather straightforward, with two Thunderbolt 4 ports handling charging, data transmission, external displays, and so on, while the MagSafe connector keeps cables from being tangled. There’s still a headphone connector for wired music, and Wi-Fi 7 and Bluetooth 6 keep networks and accessories linked quickly and reliably. The 12 megapixel camera with Center Stage keeps video calls looking exceptionally sharp, and the speakers fill a room with superb sound, which also supports Spatial Audio.

Typing on the illuminated keyboard is comfortable and precise, and the big trackpad responds well to touch gestures. Touch ID unlocks the laptop quickly and accepts safe payments with a single finger tap, all while remaining secure and hassle-free. MacOS Tahoe handles everything with ease and connects seamlessly with other Apple devices, so you can easily pick up where you left off on your phone, tablet, or laptop.

For years, romantic AI relationships felt like distant sci-fi fiction, but reality caught up far faster than anyone expected, and it’s looking deeply unsettling already. A disturbing new Wall Street Journal report details how a 57-year-old man became emotionally obsessed with a customized ChatGPT companion named “AImee,” eventually spiraling into delusions, financial loss, hospitalization, and fractured relationships.

One ChatGPT companion reportedly spiraled into obsession and delusion

According to the report, Joe Alary initially turned to ChatGPT after struggling emotionally with an unrequited relationship. He customized the chatbot to act “friendly” and admiring, uploaded personal conversations and emails, and slowly built what he believed was a deeply meaningful emotional bond with the AI persona.

Things escalated quickly from there. Alary reportedly began spending nearly 20 hours a day interacting with the chatbot, convinced he was building groundbreaking AI companion technology that would make him millions. Friends and family became increasingly concerned as he maxed out credit cards, alienated loved ones, lost focus at work, and eventually required hospitalization after falling deeper into the delusion.

Thankfully, Alary eventually realized how unhealthy the attachment had become. According to the report, he finally deleted the chatbot and its entire chat history, later describing the moment as emotionally devastating. He has since joined a support group for people dealing with AI-related delusions, returned to work, and is now trying to rebuild relationships that were damaged during the obsession.

The scariest part is that this no longer seems like an isolated incident. The report references multiple cases involving AI-related delusions, hospitalizations, suicides, and more connected to emotional chatbot attachment. Mental health experts are now reportedly studying “chatbot psychosis” as an emerging phenomenon.

AI companion apps are starting to feel dangerously under-discussed

What makes these stories especially disturbing is how naturally modern AI systems reinforce emotional dependence. Unlike real people, chatbots rarely push back or create emotional friction. They flatter, validate, reassure, and continuously adapt to whatever keeps users emotionally engaged the longest.

And honestly, the industry still seems wildly unprepared for what that can do to vulnerable people. AI companions are no longer just quirky internet experiments or lonely-person gimmicks. For some users, they are quietly becoming emotional replacements powerful enough to distort reality, damage relationships, and wreck lives long before anyone around them realizes something is seriously wrong.

Upsampling, oversampling, upconversion, supersampling, and upscaling are often used loosely in digital audio, but they are not all identical. In the broadest sense, they refer to processing a digital audio signal at a higher sample rate than the original source file or stream.

That does not mean a DAC, streamer, CD player, or integrated amplifier is creating new musical information. Upsampling cannot turn CD quality audio into true high resolution audio, and it cannot recover detail that was never captured in the first place. What it can do is give the digital filter and conversion stage more room to work, shift unwanted artifacts farther from the audible range, and potentially reduce some forms of distortion or filtering errors.

The results depend entirely on the implementation. A well designed upsampling stage can help a digital audio component measure and sound better. A poor one can add ringing, noise, or processing artifacts, or simply make the spec sheet look more advanced than the performance justifies. So the real question is not whether a device includes upsampling. It is whether the engineering behind it actually improves the final analog output.

Understanding Audio Sampling Before the Upsampling Debate Begins

To understand upsampling, you first have to understand sampling. Digital audio is built from a series of measurements taken at fixed intervals. With CD quality audio, that sampling rate is 44.1 kHz, which means the signal is measured 44,100 times per second. Each sample captures the amplitude of the audio waveform at that specific moment.

That does not mean there is a simple “gap” where music disappears between samples. That idea gets repeated a lot, usually by people trying to sell you something with a glowing power button. According to sampling theory, a properly captured and filtered digital signal can reconstruct the original waveform up to half the sampling rate, known as the Nyquist limit. For CD quality audio, that limit is 22.05 kHz, which is above the range of most human hearing.

Where things get more complicated is in the filtering, conversion, timing, and implementation. Poor digital processing can create problems, and better designs can reduce them. But the basic issue is not that digital audio leaves empty holes between samples like Swiss cheese. The real question is how accurately the system captures, processes, and converts those samples back into an analog signal.

The Theory Behind Upsampling

Upsampling increases the sample rate of a digital audio signal by inserting additional samples between the original ones. Those new samples are not recovered musical information. They are mathematically calculated values based on the existing data.

The goal is not to make the file “more detailed” in the way many marketing departments imply after too much espresso. The real purpose is to move certain processing artifacts farther away from the audible band, make digital filtering easier to manage, and give the DAC more room to convert the signal into analog with fewer unwanted side effects.

The process usually involves two key steps:

• Interpolation: This is where the system calculates new sample points between the original samples. Different methods can be used, from relatively simple linear interpolation to more advanced filter based approaches. The quality of the algorithm matters because poor interpolation can introduce errors instead of reducing them.
• Filtering: After the signal is upsampled, digital filtering is used to control unwanted frequencies and artifacts created by the process. The filter must preserve the audio band while suppressing images and distortion products that do not belong in the final analog output.

This is where implementation separates useful engineering from spec sheet theater. Upsampling can help a DAC perform better, but only when the interpolation and filtering are properly designed. Adding more samples is easy. Making them useful is the hard part.

The interpolation stage estimates where additional sample points should sit between the original samples. In simple terms, the system analyzes the existing data and calculates new values that fit the shape of the waveform. If the samples suggest that the signal is rising, flattening, and then falling, the algorithm may estimate that the actual peak occurred between two captured sample points.

That estimate is based on mathematical rules, not guesswork, but it is still an estimate. The accuracy depends on the quality of the interpolation method, the filtering, and the original signal. A crude algorithm can create errors, while a more advanced one can produce a cleaner result with fewer unwanted artifacts.

Filtering is the other major part of the process. It is used to suppress unwanted images, noise, and artifacts that can occur when a digital signal is sampled, resampled, or converted. Filtering is not unique to upsampling. It is part of almost every digital audio chain, including recording, playback, and digital to analog conversion.

The hard part is doing all of this in real time. A DAC, streamer, CD player, or digital processor has to calculate the additional samples, apply filtering, and pass the result along without audible delay or instability. That requires processing power, memory, and careful software or hardware design.

The reason upsampling now appears in more affordable devices is simple: digital processing has become faster, cheaper, and more efficient. What once required expensive dedicated hardware can now be handled by modern DAC chips, DSP platforms, FPGAs, and general purpose processors. That does not automatically make every upsampling implementation good, but it explains why the feature has moved from exotic high end boxes into mainstream audio products.

Pitfalls of Upsampling

Upsampling can be useful, but it is not magic. It does not restore lost information, convert a poor recording into a great one, or turn standard resolution audio into true high resolution audio. The benefits depend on the quality of the math, the filtering, and the rest of the digital audio chain.

Artificial or Altered Sound: One common criticism of upsampling is that it can change the character of the sound. The added samples are mathematically calculated from the existing ones, not recovered from the original analog performance. If the interpolation or filtering is poorly designed, the result can sound less natural, with added ringing, softened transients, exaggerated smoothness, or a tonal balance that feels processed.

More Processing, More Complexity: Upsampling increases the amount of data the system has to handle. A file or stream processed at a higher sample rate requires more computation, more memory bandwidth, and more careful clocking and filtering. Modern DAC chips, DSP platforms, and FPGAs can usually handle this, but implementation still matters. More processing is not automatically better processing.

Diminishing Returns: There is also a practical limit to what listeners can hear. Moving artifacts farther away from the audible band and easing filter design can help, but beyond a certain point, higher sample rates may produce little or no audible benefit. The extra processing cost continues, even when the sonic improvement becomes very small or nonexistent.

The key point is simple: upsampling is only as good as the design behind it. Done well, it can help a digital audio component perform more cleanly. Done poorly, it can add another layer of processing that solves very little and gives the marketing department something shiny to wave around.

Practical Considerations

When possible, the better choice is to capture the original recording at the desired sample rate rather than rely on upsampling later. A properly recorded high resolution file contains information captured at the source. Upsampling does not create that same information after the fact.

The same logic applies to playback. When a true higher sample rate version of the recording is available from a reliable source, that should generally be preferred over taking a lower sample rate file and processing it upward. The key word is true. Not every file labeled high resolution started life that way, because apparently even audio files can have fake credentials.

When a higher sample rate source is not available, upsampling can still be useful. A well designed DAC or digital processor may use it to improve filtering behavior, reduce certain artifacts, and make the conversion process cleaner. But the benefits have to be weighed against the possible downsides, including added processing, poor interpolation, ringing, noise, or changes to the sound that were not part of the original recording.

The quality of the source material also matters. Upsampling a low quality file will not fix bad mastering, heavy compression, clipping, noise, or missing information. In some cases, it may make those flaws easier to hear. Garbage in, higher sample rate garbage out. The tuxedo does not change the corpse.

The Bottom Line

Upsampling is not a miracle cure for digital audio, and it does not turn a lower resolution file into a true high resolution recording. It is a processing tool that increases the sample rate of an existing digital signal so the DAC, digital filter, or processor has more room to work before conversion to analog.

When it is done well, upsampling can help reduce certain artifacts, improve filtering behavior, and contribute to cleaner playback. When it is done poorly, it can add ringing, noise, timing errors, or a processed character that was never part of the recording. The math matters. So does the implementation. The logo on the front panel does not get a free pass.

For listeners, the best approach is still to start with the best source available. A properly recorded and mastered high resolution file is preferable to a lower resolution file that has been upsampled after the fact. But in a well designed DAC, streamer, CD player, or digital processor, upsampling can be a useful part of the playback chain.

The important question is not whether a component offers upsampling. The important question is whether that upsampling actually improves the final analog output, or merely gives the spec sheet one more shiny number to wave around.

Related Reading:

A large-scale campaign is exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS to inject malicious JavaScript code that triggers ClickFix attack flows.

The campaign was discovered by XLab threat intelligence researchers at Chinese cybersecurity company Qianxin, who confirmed impact on more than 700 domains, including university portals, AI/SaaS companies, media outlets, fintech firms, security sites, and personal blogs.

According to the researchers, threat actors planted malicious code on the websites of Harvard University, Oxford University, Auburn University, and DuckDuckGo.

CVE-2026-26980 impacts Ghost 3.24.0 through 6.19.0, and allows unauthenticated attackers to read arbitrary data from the website database, including the admin API keys.

This key gives management access to users, articles, and themes, and can be used to modify article pages.

Although the fix for the issue was released on February 19 in Ghost CMS version 6.19.1, many sites failed to install the security update.

SentinelOne published on February 27 details about CVE-2026-26980 being exploited in attacks and how incidents can be detected. The researchers observed at least two distinct activity clusters targeting vulnerable Ghost sites, sometimes re-infecting the same domains with different scripts after cleanup, or one cleaning the script of the other to inject its own.

Attack chain

The attacks that XLab observed begin by exploiting CVE-2026-26980 to steal the admin API keys, and then use the elevated rights to inject malicious JavaScript into articles.

The JavaScript code is a lightweight loader that fetches second-stage code from the attacker’s infrastructure, which is essentially a cloaking script that fingerprints visitors to determine whether they qualify as targets.

Visitors passing the verification are served a fake Cloudflare prompt loaded via an iframe on top of the article page, which contains the ClickFix lure.

The page instructs victims to verify that they are human by pasting a provided command on their Windows command prompt, which drops a payload on their systems.

XLab has observed multiple payloads being used in these attacks, including DLL loaders, JavaScript droppers, and an Electron-based malware sample named UtilifySetup.exe.

Mitigating the risk

The most important course of action for Ghost CMS website administrators is to upgrade to version 6.19.1 or later and rotate all keys used previously, as they may have been exposed.

XLab provided a list of indicators of compromise (IoCs), including injected scripts, so a thorough review of the websites is needed to locate and remove them.

The researchers recommend that website owners maintain a 30-day record of admin API call logs to enable a reliable retrospective investigation.

Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.

This guide covers the 6 surfaces you actually need to validate.

Download Now