42
42
57
57
57
42
42
42
57
57
42
42
StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
Check Point details StopAndProtect: ~2,000 compromised WordPress sites deliver ClickFix fake-CAPTCHA malware toolkit combining ransomware, credential theft, screenshots, and WhatsApp surveillance.
Check Point researcher Jaromír Hořejší reports the campaign begins with ClickFix fake-CAPTCHA prompts that trigger a PowerShell command, then two .NET downloader stages that launch six components: SilentEncryptor, NetworkShareScanner, a VBS spreader, LockScreen, SimpleChatProxy, and SilentDataCollector. Hacked WordPress sites host malware stages, serve C2 commands, and receive exfiltrated logs; the actors installed a self-deleting WordPress plugin enabling arbitrary PHP upload anywhere under the WordPress root. From mid-May to late July 2026 the operators exfiltrated more than 700 archives including screenshots every 30 seconds, keylogger output, and WhatsApp contact data, and opsec failures exposed their Visual Basic automation tooling and lists of nearly 2,000 compromised domains.
60
42
StopAndProtect Turns 2,000 Hacked WordPress Sites Into a Criminal Network
Check Point uncovered StopAndProtect, a cybercrime operation using ~2,000 hacked WordPress sites for ClickFix-driven malware delivery, data theft, surveillance, and ransomware.
Check Point Research identified the StopAndProtect operation in May 2026; it abuses close to 2,000 compromised WordPress sites, many running outdated software, to host malware stages, act as C2, and store stolen data. Infection starts with fake CAPTCHA ClickFix prompts that trick visitors into running a PowerShell command, followed by .NET downloaders deploying ransomware, SMB/USB worm, lockscreen, chat, and credential-stealing components. Rather than always encrypting, operators selectively exfiltrate file lists and specific files; researchers found 700+ stolen-data archives, roughly 31,000 screenshots, and 6,000+ unique victim IP addresses, including WhatsApp activity monitoring.
58
42
57
57
42
42
57
42
57
ClickFix attacks are tricking Mac and Windows users into hacking themselves
ClickFix campaigns trick users into pasting terminal commands via fake CAPTCHAs; latest wave abused HBO Max's hacked Reddit account to push infostealer ads.
ClickFix attacks use fake CAPTCHA or anti-bot prompts on hacked or counterfeit websites to convince victims to copy a command into Windows Command Prompt or macOS Terminal, instantly installing infostealers that steal passwords, logged-in sessions, and crypto wallets. The latest campaign compromised HBO Max's official Reddit account to post hundreds of fake ads linking to a spoofed HBO Max page carrying the lure, per researchers at Hudson Rock. It is unclear how many users were compromised. Because execution happens in the terminal, many attacks evade antivirus tools; enterprises can block terminals domain-wide and Mac users can deploy BlockBlock.
68
42
42
47
42
57
57
42
42
42
AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure
NSA, CISA, FBI, DOE and EPA warn that actors use AI-generated Python scripts to exploit internet-exposed Siemens S7 PLCs at U.S. critical infrastructure.
A joint advisory from NSA, CISA, FBI, DOE and EPA describes an active threat in which AI-generated exploit scripts disguised as legitimate monitoring tools target Siemens S7 Series PLCs (S7-200 through S7-1500, including F-series safety controllers). The actors use Censys and ZoomEye scanning to find internet-exposed, outdated PLCs and a custom Python script using snap7 libraries over the S7comm protocol for initial access, credential access and denial of service; no attribution was given. Targeted sectors include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities, with potential for process disruption and cascading impacts. A related Dream report details a near-autonomous AI-agent campaign (July 1-4, 2026, 12 waves) against Taiwan government entities, using Hermes and OpenClaw agents with eight parallel sub-agents to crack 85 accounts via password spraying and exfiltrate over 2,564 personnel records, SSO client secrets and database credentials.
80
42
57
42
42
42
42