StopAndProtect Turns 2,000 Hacked WordPress Sites Into a Criminal Network
Check Point uncovered StopAndProtect, a cybercrime operation using ~2,000 hacked WordPress sites for ClickFix-driven malware delivery, data theft, surveillance, and ransomware.
Check Point Research identified the StopAndProtect operation in May 2026; it abuses close to 2,000 compromised WordPress sites, many running outdated software, to host malware stages, act as C2, and store stolen data. Infection starts with fake CAPTCHA ClickFix prompts that trick visitors into running a PowerShell command, followed by .NET downloaders deploying ransomware, SMB/USB worm, lockscreen, chat, and credential-stealing components. Rather than always encrypting, operators selectively exfiltrate file lists and specific files; researchers found 700+ stolen-data archives, roughly 31,000 screenshots, and 6,000+ unique victim IP addresses, including WhatsApp activity monitoring.
- ~2,000 hacked WordPress sites host malware stages, act as C2, and store stolen files.
- Infection starts with fake CAPTCHA ClickFix prompts pushing visitors to run a PowerShell command.
- Toolkit includes ransomware, SMB/USB worm, lock screen, chat utility, and credential stealer; theft is selective.
- Researchers found 700+ stolen archives, ~31,000 screenshots, and 6,000+ victim IPs; WhatsApp monitored.
- Many compromised sites ran outdated WordPress or plugins, one 2021 version with ~40 flaws.
- ATT&CK
- T1189 Drive-by CompromiseT1059.001 PowerShellT1486 Data Encrypted for ImpactT1091 Replication Through Removable MediaT1113 Screen Capture
- Vendors
- Check PointWordPress
- Products
- WordPress
- Threat actors
- StopAndProtect
- Organizations
- Check Point
From the original article
5 min read at securityaffairs.com
StopAndProtect turned nearly 2,000 hacked WordPress sites into a criminal network for malware delivery, data theft, surveillance and ransomware. Check Point Research uncovered a cybercrime operation, dubbed StopAndProtect, that has turned thousands of hacked WordPress websites into a shared platform for malware delivery, data theft, surveillance and ransomware.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.