45
42
StopAndProtect Turns 2,000 Hacked WordPress Sites Into a Criminal Network
Check Point uncovered StopAndProtect, a cybercrime operation using ~2,000 hacked WordPress sites for ClickFix-driven malware delivery, data theft, surveillance, and ransomware.
Check Point Research identified the StopAndProtect operation in May 2026; it abuses close to 2,000 compromised WordPress sites, many running outdated software, to host malware stages, act as C2, and store stolen data. Infection starts with fake CAPTCHA ClickFix prompts that trick visitors into running a PowerShell command, followed by .NET downloaders deploying ransomware, SMB/USB worm, lockscreen, chat, and credential-stealing components. Rather than always encrypting, operators selectively exfiltrate file lists and specific files; researchers found 700+ stolen-data archives, roughly 31,000 screenshots, and 6,000+ unique victim IP addresses, including WhatsApp activity monitoring.
58
57
57
45
McKesson confirms cyber incident after ShinyHunters claims patient-data theft
Healthcare giant McKesson confirmed a cyber incident after ShinyHunters claimed theft of hundreds of millions of patient records.
McKesson acknowledged a data breach following public claims by the threat actor group ShinyHunters that it stole hundreds of millions of records containing patient data. The company confirmed a cyber incident occurred but the full scope of the theft has not yet been independently verified. ShinyHunters is known for large-scale data theft and extortion against major organizations. The healthcare sector remains a frequent target for data-theft extortion groups.
80
42
45
57
57
45
42
55
57
57
57
45
60
45
57
57
57
60
57
57
60
55
57
60
60
47
47
60
60
60
30
57
57
60