The StopAndProtect campaign is a particularly useful case study because it shows how attackers can transform ordinary, poorly maintained websites into a distributed criminal infrastructure for malware delivery, command-and-control, surveillance, data theft and ransomware. Check Point Research estimates that close to 2,000 compromised WordPress websites were being used by the operators, while campaign telemetry showed more than 6,000 unique affected IP addresses as of July 24, 2026. The United States accounted for the largest number, followed by Russia and India, with India alone representing around 630 observed IPs.

The initial infection mechanism is ClickFix, a social-engineering technique that has become increasingly popular because it persuades users to infect themselves. Victims visiting a compromised WordPress site are shown a fake CAPTCHA or verification prompt and are instructed to perform steps outside the browser. The malicious page copies a PowerShell command into the clipboard, and when the user manually runs it, that command downloads and executes the next stage. This is important because the attack does not necessarily begin with exploitation of a vulnerability on the victim's endpoint. The attacker convinces the user to execute the payload voluntarily, which can bypass some of the assumptions traditional security controls make about how malware enters a system.

The malware chain is considerably more sophisticated than a simple ransomware infection. After the initial PowerShell execution, two additional .NET downloader and loader stages are deployed before the main payload components are introduced. These include SilentEncryptor for ransomware, NetworkShareScanner for propagation through SMB shares and USB devices, a VBS spreader capable of lateral movement through WMI, a LockScreen component, a custom chat utility, and SilentDataCollector for information theft. The operation therefore gives the attacker several choices after compromise rather than forcing every victim into the same ransomware workflow.

That flexibility is one of the most significant aspects of StopAndProtect. Check Point observed that ransomware was not deployed on every infected machine. In many cases, the operators first enumerated available drives and files, exfiltrated the resulting file lists and then selectively instructed the malware to steal particular documents. This reflects the broader evolution of ransomware operations toward data-driven extortion. Encryption may still be available as leverage, but quietly stealing useful data first can be considerably more valuable than immediately announcing the attack by encrypting the endpoint.

The SilentDataCollector component demonstrates just how intrusive this surveillance can become. Newer versions include keylogging with detection of valid email addresses, screenshot capture every 30 seconds while the user is active, manipulation of network shares and even automated searches within WhatsApp. The operator can specify a contact name, wait until the victim becomes inactive, automate the WhatsApp interface, search for that contact and capture the resulting contact information. At that point the compromised computer is no longer simply an infected endpoint; it has effectively become a remotely operated surveillance platform.

The network-propagation capabilities are equally concerning for enterprises. NetworkShareScanner enumerates accessible SMB shares and removable devices, while the VBS component can spread across disks and USB media and perform remote process creation through WMI. This means that compromise of one employee endpoint can become a starting point for internal propagation, particularly in environments where file shares are widely accessible, administrative credentials are reused or workstation-to-workstation communication is unrestricted. The malware does not need to discover an exotic zero-day if the internal network already provides convenient paths between systems.

The use of compromised WordPress sites is perhaps the most interesting infrastructure element of the campaign. These websites are not merely redirectors. They are used to host malware stages, operate as command-and-control servers, receive logs and store data stolen from victims. Using legitimate websites gives the attacker a distributed and disposable infrastructure layer while making simple reputation-based blocking considerably harder. A connection to an established business website may initially appear less suspicious than communication with an obviously malicious newly registered domain, even though the site itself has been compromised.

The attackers appear to have obtained many of these WordPress sites because they were simply not being maintained. Check Point examined one compromised site that was still running a WordPress version from 2021 and found nearly 40 potential vulnerabilities across WordPress and its installed components, including SQL injection, authentication bypass, arbitrary file upload and other issues. This illustrates a recurring problem with public websites: organisations frequently treat them as low-value marketing infrastructure, yet attackers can turn them into trusted distribution points for attacks against entirely unrelated victims.

Persistence on the compromised WordPress sites is also technically interesting. The attackers deployed a custom must-use WordPress plugin under the `wp-content/mu-plugins` directory. This plugin created a hidden REST API endpoint and allowed anyone possessing hardcoded credentials to upload files, including PHP files, to paths beneath the WordPress root. Because PHP uploads could subsequently be executed by the server, the mechanism effectively provided remote code execution and persistent control over the website. Must-use plugins are particularly attractive for persistence because they automatically load on every request and do not appear or behave like ordinary plugins inside the standard WordPress plugin interface.

The attacker also showed clear awareness of operational concealment. The original installer deactivated and deleted itself after installing the persistent component, reducing the obvious evidence visible to an administrator. Additional custom PHP tools provided file upload, deletion and remote file-management capability. The operator even maintained a Visual Basic 6 automation tool capable of managing large numbers of compromised WordPress sites, activating or disabling fake CAPTCHA pages, uploading additional components and controlling caching behaviour. The tooling may be technologically old-fashioned in places, but apparently cybercrime has no requirement to use fashionable frameworks if something from the previous century still works perfectly well.

One of the more unusual aspects of the investigation was that poor operational security by the attackers exposed a large amount of their own infrastructure and victim information. Open directories revealed malware samples, logs and screenshots from infected systems. Researchers collected approximately 31,000 screenshots during part of the investigation, while more than 700 archives containing stolen victim data were identified between mid-May and the end of July. In what appears to have been an accidental self-infection, the operators may even have uploaded their own development files, revealing source code and lists of compromised domains.

For customers, the first protection priority is user awareness around ClickFix attacks. Legitimate CAPTCHA systems do not require users to open PowerShell, Windows Run, Command Prompt or Terminal and paste commands copied from a website. Organisations should specifically train users on this behaviour rather than relying on generic advice such as "do not click suspicious links." ClickFix succeeds precisely because the page may appear legitimate and the user is persuaded to execute the final command themselves. Any browser page asking a user to paste or execute a system command should be treated as hostile.

Endpoint controls should then make that social-engineering step difficult to convert into execution. PowerShell should be constrained according to organisational requirements, with script-block logging and command-line telemetry enabled. Security teams should monitor for PowerShell processes launched interactively after browser activity, hidden PowerShell windows, execution-policy bypass parameters, in-memory .NET loading and unusual network connections initiated by PowerShell. Application-control policies can further restrict unapproved scripts and executables, while endpoint detection should focus on the behavioural chain rather than attempting to identify only the final ransomware executable.

Network segmentation is particularly important because StopAndProtect includes SMB, USB and WMI propagation capabilities. Workstations should not automatically be permitted unrestricted SMB or WMI communication with every other workstation. Administrative protocols should be restricted to management systems and authorised administrators, while sensitive server networks should be separated from normal user segments. If an infected desktop can enumerate and reach hundreds of neighbouring systems, the internal network has effectively volunteered to become part of the malware's distribution architecture.

Organisations should also monitor outbound communications based on behaviour rather than depending exclusively on domain reputation. Because compromised WordPress sites are used as C2 and exfiltration infrastructure, some destinations may have long-established domains and apparently legitimate content. Large or repetitive POST requests to unusual websites, regular beaconing patterns, encrypted archive uploads, unexplained connections from endpoints to unrelated WordPress sites and endpoints communicating with large numbers of otherwise unrelated web domains should therefore attract attention. SSL inspection, where legally and operationally appropriate, can provide additional visibility into suspicious application-layer behaviour.

Data protection becomes equally important because the campaign actively identifies and selectively steals files. Security controls should therefore monitor not only malware execution but also unusual access to large numbers of documents, unexpected compression or encryption of files before transmission, bulk access to network shares and abnormal outbound transfers. Data-loss-prevention and contextual monitoring can provide useful signals because the attacker's objective may be the information itself rather than the endpoint. A system that blocks ransomware encryption but allows sensitive engineering documents, financial data or customer records to be quietly exfiltrated has prevented only the noisier half of the incident.

The campaign also demonstrates why WordPress security needs more attention from organisations that operate public websites. WordPress core, plugins and themes should be updated promptly; unused plugins should be removed rather than merely disabled; administrative access should use strong unique credentials and MFA; file modifications should be monitored; and organisations should periodically inspect `wp-content/mu-plugins` for unexpected must-use plugins. Web application firewalls and file-integrity monitoring can add another defensive layer, but they are not substitutes for patching a WordPress installation that has been abandoned for several years.

If a WordPress site is found compromised, simply deleting the visible malicious plugin may not be sufficient. Administrators should inspect the entire document root for unfamiliar PHP files, hidden uploaders, modified core files, unexpected REST endpoints and changes to configuration files. Credentials associated with WordPress, hosting panels, databases, FTP/SFTP and deployment accounts should be rotated, and the server should be reviewed for persistence outside WordPress itself. Where confidence in the integrity of the installation cannot be established, rebuilding the website from a known-good source may be safer than repeatedly removing whatever malicious file happens to be visible that day.

The broader lesson from StopAndProtect is that modern malware campaigns increasingly combine social engineering, legitimate infrastructure abuse, malware modularity, credential theft, lateral movement, surveillance, selective data exfiltration and ransomware into one operational framework. Looking only for the ransomware stage misses most of the attack. By the time encryption begins, the attacker may already have mapped network shares, captured credentials, monitored user activity, stolen documents and established persistence across multiple systems.

Customers should therefore defend against the entire chain: keep public web infrastructure patched, educate users specifically about ClickFix, restrict PowerShell and script execution, monitor endpoint behaviour, segment SMB and WMI traffic, control removable media, inspect unusual outbound traffic and maintain visibility into sensitive data access. The useful question is no longer simply "Can our antivirus detect StopAndProtect?" It is whether the organisation can recognise when a legitimate website becomes malicious infrastructure, when a user is persuaded to execute an unexpected command, when one endpoint begins behaving like a worm, and when apparently normal HTTPS traffic starts carrying stolen data out of the network. StopAndProtect succeeds by crossing several security boundaries in sequence, which means effective defence must be layered across those same boundaries.

Cybersecurity researchers have flagged a global cybercrime operation that abuses thousands of hacked WordPress websites as infrastructure to disseminate malware, commandeer infected hosts, store stolen documents, screenshots, and activity logs created to track the status of the activity. "The operation doesn't rely on a single piece of malware, but on a whole toolkit of criminal software

Source: StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data via The Hacker News — published 19 Aug 2026.