# Helix Ultimate Mega Menu Hack 1. [Home](https://mysites.guru/) 2. [Tools](https://mysites.guru/tools/) 3. [Hacked site detection](https://mysites.guru/tools/hacked-site-detection/) 4. Helix Ultimate Mega Menu Hack # Helix Ultimate Mega Menu Hack ![Helix Ultimate Mega Menu Hack](https://mysites.guru/_astro/helix-ultimate-mega-menu-hack.Dvs4qeM5_2amH2a.webp) A Helix Ultimate Joomla extension mega-menu setting can carry a stored XSS payload that never touches a file, so scanners miss it. How to check and clean it. Article Contents - [What the mega menu hack check decodes](#what-the-mega-menu-hack-check-decodes) - [How an anonymous write reaches your admin session](#how-an-anonymous-write-reaches-your-admin-session) - [The difference between a badge and a backdoor](#the-difference-between-a-badge-and-a-backdoor) - [Patching Helix Ultimate and cleaning the menu](#patching-helix-ultimate-and-cleaning-the-menu) - [Scanning mega menu layouts twice a day](#scanning-mega-menu-layouts-twice-a-day) - [Further Reading](#further-reading) - [Frequently Asked Questions](#faq) ## What the mega menu hack check decodes Helix Ultimate is one of the most widely used Joomla template frameworks, and this check reads every menu item on a site whose params have a Helix Ultimate mega-menu layout straight from the Joomla database, decodes the nested layout, and inspects every setting inside it at any depth: the badge, the custom HTML, the CSS class, and anything buried in the rows and columns. The attacker chooses where to write, so the check is not limited to a fixed list of fields. A menu item is only flagged on unmistakable injection tells: loader fingerprints such as code run through `eval` or `atob`, a script sourced from a `data:` or `blob:` URI, a script whose `src` is really a font, image or stylesheet file (no script is ever legitimately served from a `.ttf` or `.png`), an external fetch or `sendBeacon` call to a hard-coded host, the self-registration shape that creates a new Super User account from a visitor’s browser, or script and markup where only a plain label or class name belongs. A quote character inside a CSS class field is a particular tell, since that is how the attacker breaks out of the attribute and opens a script tag. Real badges, custom HTML, embedded widgets and class names match none of these and are never flagged. ## How an anonymous write reaches your admin session Versions of Helix Ultimate before 2.2.7, [the release that closed this unauthenticated menu write](https://mysites.guru/blog/helix-ultimate-security-update/), registered an ajax handler, `saveMegaMenuSettings`, reached anonymously through Joomla’s `com_ajax` dispatcher, that saved its settings before checking who was asking. That let an anonymous attacker write mega-menu settings straight into the `#__menu` params in the database, all of which Joomla echoes into the page that renders the menu. The flaw is tracked as [CVE-2026-57829](https://mysites.guru/vulnerabilities/CVE-2026-57829/) and [CVE-2026-57830](https://mysites.guru/vulnerabilities/CVE-2026-57830/), both assigned by the Joomla CNA in July 2026. The campaign observed in the wild writes a stored cross-site scripting payload: a script planted in one of those settings that runs in the browser of anyone who loads a page with that menu, including an administrator. Because the script runs in an authenticated admin session the moment a logged-in editor opens a page using the poisoned menu, it does not need its own login at all. It then submits Joomla’s own registration form to create a hidden Super User account and beacons out to a command server, so by the time anyone notices the injected content the site may already have a second, silent way in. Because the payload lives in a database column rather than a file, the site’s files all hash clean, which is exactly why a database-side check is needed to catch it. Cleaning the menu items is only half the job: the worm leaves a rogue Super User behind, so a flagged site should always get a [full check for rogue admin accounts](https://mysites.guru/tools/hacked-site-detection/rogue-super-admin-accounts/) as well, and treating one poisoned menu item as the whole of the compromise is the mistake that lets the attacker walk straight back in through the account they already planted. A separate, unrelated cosmetic issue Some sites show an empty box when hovering a menu item with the mega-menu flag switched on but an empty layout, a leftover from pre-2.x Helix Ultimate. The wrapper markup is drawn purely because the flag is set, not because there is content to show. It is not a breach and never counts toward a site being flagged. ## The difference between a badge and a backdoor Every menu item’s mega-menu settings contain only content your team put there: real badge text, intentional custom HTML, and class names free of quote characters or angle brackets. Nothing in the layout fetches from an external host, rewrites the page title, or submits a form on the visitor’s behalf. Legitimate mega-menu setting Rogue setting Badge A short, plain label Markup, a script tag, or an `eval`/`atob` call CSS class A plain class name Contains a quote or angle bracket Script source Absent, or a known asset URL A `data:`/`blob:` URI, or a font/image file extension Network activity None An external fetch or `sendBeacon` to a hard-coded host ## Patching Helix Ultimate and cleaning the menu 1. **Update Helix Ultimate to the current version first.** Cleaning without patching invites an immediate re-injection, since the vulnerable versions accept the same write from any anonymous visitor. In the administrator, go to System, then Update, then Extensions, and update Helix Ultimate. 2. **Preserve anything you need before cleaning.** If any of the affected settings held content you wrote yourself, copy it out. The clean-up below removes it. 3. **Inspect and clean every menu item’s mega-menu settings.** In the administrator, go to Menus, open each menu item using a Helix Ultimate mega-menu layout, and check the badge, custom HTML, CSS class and nested rows/columns for any of the tells described above. Remove anything that matches; leave everything else untouched. 4. **Check for a rogue Super User.** The observed campaign uses this foothold to create a hidden Super User account. See [Rogue Super Admin Accounts](https://mysites.guru/tools/hacked-site-detection/rogue-super-admin-accounts/) and remove anything you do not recognise. 5. **Clear the Joomla cache** so no cached page keeps serving the injected script after the clean-up. 6. **Check the rest of your portfolio.** This is automated, sprayed tooling; every site running Helix Ultimate below the current version is a target. ## Scanning mega menu layouts twice a day On every snapshot, twice a day, mySites.guru decodes every mega-menu layout on the site and checks it against the tells above, at any depth. Where a setting matches, we show you exactly which field triggered the flag and an excerpt of what is in it, so you can verify it before anything changes. ## [Helix Ultimate Mega Menu Hack](https://mysites.guru/free-audit/?check=joomla/hacked/helixmenucode) mySites.guru checks every connected site for this automatically and flags it the moment it appears. These run twice a day on every connected site. [Check your site for free](https://mysites.guru/free-audit/?check=joomla/hacked/helixmenucode) ## Further Reading - [Helix Ultimate 2.2.7 Closes an Unauthenticated Menu Write](https://mysites.guru/blog/helix-ultimate-security-update/) - [Helix Ultimate 2.2.10 Fixes Twelve Security Issues, Including a Pre-Login Bypass](https://mysites.guru/blog/helix-ultimate-2-2-10-security-release/) JoomShaper has shipped further Helix Ultimate security releases since 2.2.7. Update to the current version, not just the one that closed this specific hole. ## Frequently Asked Questions Show all What is the Helix Ultimate mega menu hack? It exploits an ajax handler in the Helix Ultimate Joomla extension, saveMegaMenuSettings, that saved settings before checking who was asking. Versions before 2.2.7 let an anonymous attacker write straight into a menu item's mega-menu settings in the #\_\_menu table, which Joomla then echoes into every page that renders the menu, planting a stored cross-site scripting payload. Will a file scanner catch this? No. The payload lives in a database column, not a file, so every file on the site hashes clean. That is exactly why a database-side check is needed to catch it, and why the site's files passing a scan is not evidence the site is clean. My menu item shows an empty box when I hover it. Is that this hack? Probably not. A leftover pre-2.x Helix Ultimate setting can leave the mega-menu flag switched on with an empty layout, which draws a wrapper box with nothing inside it purely because the flag is set, regardless of content. It is a cosmetic leftover, not a compromise, and never counts toward a site being flagged as hacked. [![EU icon: AI MODIFIED](https://mysites.guru/_astro/ai-modified.CaoawZEQ_1In0VX.webp)Written and edited by a human, with AI assistance. Our approach to AI](https://mysites.guru/ai-statement/) ### Article Contents - [What the mega menu hack check decodes](#what-the-mega-menu-hack-check-decodes) - [How an anonymous write reaches your admin session](#how-an-anonymous-write-reaches-your-admin-session) - [The difference between a badge and a backdoor](#the-difference-between-a-badge-and-a-backdoor) - [Patching Helix Ultimate and cleaning the menu](#patching-helix-ultimate-and-cleaning-the-menu) - [Scanning mega menu layouts twice a day](#scanning-mega-menu-layouts-twice-a-day) - [Further Reading](#further-reading) - [Frequently Asked Questions](#faq) - **Published** - 28 August 2026 - **Applies to** - Joomla - **One-click fix** - Manual fix Share [](https://x.com/intent/post?url=https%3A%2F%2Fmysites.guru%2Ftools%2Fhacked-site-detection%2Fhelix-ultimate-mega-menu-hack%2F&text=Helix%20Ultimate%20Mega%20Menu%20Hack)[](https://bsky.app/intent/compose?text=Helix%20Ultimate%20Mega%20Menu%20Hack%20https%3A%2F%2Fmysites.guru%2Ftools%2Fhacked-site-detection%2Fhelix-ultimate-mega-menu-hack%2F)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fmysites.guru%2Ftools%2Fhacked-site-detection%2Fhelix-ultimate-mega-menu-hack%2F) Topics [Hacked site detection](https://mysites.guru/tools/hacked-site-detection/)Joomla ★★★★★ > "mySites.guru has been one of my best decisions for many many years. I run [well over 600+ websites](https://mysites.guru/manage-multiple-wordpress-sites/) and simply could not do it without [this amazing service](https://mysites.guru/features/). Thank you, Phil!" ![John Palmer](https://mysites.guru/images/reviews/john-palmer.webp) John PalmerEmpro Web Development [](https://mysites.guru/reviews/) ## More checks in [Hacked site detection](https://mysites.guru/tools/hacked-site-detection/) - [ ### Helix3 Custom Code Hack The Helix3 Joomla extension Custom Code template fields can carry a database-only defacement payload that file scanners never see. How to check and clean it. ](https://mysites.guru/tools/hacked-site-detection/helix3-custom-code-hack/) - [ ### Impostor Plugin Identities One malware family invents a plugin, an author and a vendor domain per site it breaks into, and the three agree in a way a real vendor identity rarely does. ](https://mysites.guru/tools/hacked-site-detection/impostor-plugin-identities/) - [ ### Check for JCE Rogue Profiles & Backdoors A rogue JCE editor profile lets an attacker re-upload a webshell after every clean-up. How to spot the fake profile and the files it plants on a Joomla site. ](https://mysites.guru/tools/hacked-site-detection/jce-rogue-profiles/) - [ ### Check For Malicious Cron Jobs A cron job that quietly re-downloads malware after every clean-up is why a hacked Joomla site keeps reinfecting itself. How to find one and remove it safely. ](https://mysites.guru/tools/hacked-site-detection/malicious-cron-jobs/) - [ ### Check For Malicious Scheduled Tasks Joomla has run a scheduler of its own since 4.1, in a database table that no crontab lists and no file scanner reads. How a planted task is found and removed. ](https://mysites.guru/tools/hacked-site-detection/malicious-joomla-scheduled-tasks/) - [ ### Check For Malicious WP-Cron Events WordPress runs its own scheduler out of one database row, where no server crontab and no file scanner can see it. How a planted event is found and removed. ](https://mysites.guru/tools/hacked-site-detection/malicious-wp-cron-events/) ## See where your own sites stand One free audit of one site · no card · about 2 minutes to connect [Get Your Free Site Audit](https://manage.mysites.guru/en/register) [What the mega menu hack check decodes](#what-the-mega-menu-hack-check-decodes) [How an anonymous write reaches your admin session](#how-an-anonymous-write-reaches-your-admin-session) [The difference between a badge and a backdoor](#the-difference-between-a-badge-and-a-backdoor) [Patching Helix Ultimate and cleaning the menu](#patching-helix-ultimate-and-cleaning-the-menu) [Scanning mega menu layouts twice a day](#scanning-mega-menu-layouts-twice-a-day) [Further Reading](#further-reading) [Frequently Asked Questions](#faq)