StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
Check Point details StopAndProtect: ~2,000 compromised WordPress sites deliver ClickFix fake-CAPTCHA malware toolkit combining ransomware, credential theft, screenshots, and WhatsApp surveillance.
Check Point researcher Jaromír Hořejší reports the campaign begins with ClickFix fake-CAPTCHA prompts that trigger a PowerShell command, then two .NET downloader stages that launch six components: SilentEncryptor, NetworkShareScanner, a VBS spreader, LockScreen, SimpleChatProxy, and SilentDataCollector. Hacked WordPress sites host malware stages, serve C2 commands, and receive exfiltrated logs; the actors installed a self-deleting WordPress plugin enabling arbitrary PHP upload anywhere under the WordPress root. From mid-May to late July 2026 the operators exfiltrated more than 700 archives including screenshots every 30 seconds, keylogger output, and WhatsApp contact data, and opsec failures exposed their Visual Basic automation tooling and lists of nearly 2,000 compromised domains.
- Nearly 2,000 WordPress sites serve malware stages, C2 commands, and exfiltrated logs; many ran outdated software.
- Stage 3 deploys six components: SilentEncryptor, NetworkShareScanner, VBS spreader, LockScreen, SimpleChatProxy, SilentDataCollector.
- Self-deleting WordPress plugin allows credential-holders to upload PHP files, enabling remote code execution.
- Newer stealers add keylogging, WhatsApp contact search, network share mapping, and screenshots every 30 seconds.
- Operator opsec failures exposed infection logs, screenshots, and a Visual Basic botnet management tool.
- ATT&CK
- T1189 Drive-by CompromiseT1059.001 PowerShellT1486 Data Encrypted for ImpactT1056.001 KeyloggingT1091 Replication Through Removable Media
- Vendors
- Check PointWordPress
- Products
- WordPress
- Threat actors
- StopAndProtect
- Organizations
- Check Point
From the original article
5 min read at thehackernews.com
Cybersecurity researchers have flagged a global cybercrime operation that abuses thousands of hacked WordPress websites as infrastructure to disseminate malware, commandeer infected hosts, store stolen documents, screenshots, and activity logs created to track the status of the activity.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.