StopAndProtect Malware Uses 2,000 Hacked WordPress Sites

A global cybercrime operation named StopAndProtect has turned close to 2,000 hacked WordPress websites into infrastructure for spreading malware, stealing sensitive files, and coordinating further attacks, according to a report from Check Point Research. The researchers discovered a ransomware family of the same name in mid-May 2026 and then mapped the wider campaign. WordPress is the content management system behind a large share of the world's websites, which makes poorly maintained installations an attractive target. Check Point says the operation does not rely on a single piece of malware but on a whole toolkit of criminal software working together, with different components for encrypting files, silently stealing documents, locking screens, and even chatting live with victims.

The infection begins with a ClickFix social engineering attack, the name given to fake CAPTCHA style prompts that instruct visitors to copy, paste, and run a command. On a Windows computer, running that command launches a PowerShell script, a built in Windows automation and command tool. The script then starts a chain of .NET downloaders and loaders, which are programs written for Microsoft's .NET framework that fetch and run more code from the attackers' servers. According to Check Point, the first stage reports statistics back to the command and control server, or C2, and loads the next stage. A second stage performs checks for analysis sandboxes and adds more logging before launching the main components. The third stage contains six tools: SilentEncryptor, which encrypts either all infected computers or only those with specific host names; NetworkShareScanner, which spreads to other devices like an SMB or USB worm, meaning it can jump through shared folders and removable drives; a VBS spreader that propagates through hard disks and removable media and moves laterally via WMI, a Windows management technology; LockScreen, which blocks user input and shows a ransom note with a payment QR code; SimpleChatProxy, a custom chat application that connects the victim and the operator; and SilentDataCollector, which builds a list of all drives, encrypts that list, and sends it to the C2 server. The attacker can upload a command file that the stealer reads to collect specific files. Check Point also found that newer versions of the data collector add extra capabilities, including a keylogger, software that records every key a user presses, with valid email address detection, the ability to pull data from WhatsApp, mapping and unmapping network shares, and taking screenshots of user activity every 30 seconds. An operator can issue a WhatsApp search keyword for both web and desktop versions; the stealer waits until the victim is inactive, then uses WhatsApp automation to focus the search box, enter the keyword, open the contact information, and capture a screenshot. Check Point notes that the campaign does not always end in ransomware; in most observed cases the attackers secretly stole lists of files and then exfiltrated selected documents.

The hacked WordPress sites serve three main purposes: hosting malware stages, running as command and control servers to send instructions, and storing logs stolen from victims. Check Point said its researchers gained deeper visibility because of operational security mistakes by the attackers that exposed detailed infection logs, screenshots from victim machines, and the tools used to mass manage compromised websites. Many of the sites run outdated versions of WordPress and outdated plugins. One compromised website was running a WordPress version from 2021, leaving it open to roughly 40 different vulnerabilities. The sites are tampered with to show fake ClickFix CAPTCHA prompts to visitors. To install a backdoor, the attackers upload a ZIP archive containing a PHP file called uploader-installer.php. PHP is the programming language WordPress is built on. That file installs a custom WordPress plugin and then uses it to create a must-use (MU) plugin file in the wp-content/mu-plugins directory. An MU plugin runs automatically on a WordPress site. This plugin allows anyone with valid credentials to upload arbitrary files, including PHP files, to almost any path under the WordPress root. Uploading PHP files can lead to remote code execution, meaning the attacker can run their own code on the server. After the site is compromised, the plugin deactivates itself and self deletes to avoid detection. The uploaded files include stolen data from victim machines. Check Point counted more than 700 archives between mid May and the end of July 2026. Among those files were internal development tools that appear to come from the operator accidentally infecting their own machine, including a custom automation utility named fMain.frm that is used to manage compromised WordPress sites. That tool lets the operator mass manage compromised pages, upload or delete files, and toggle the fake CAPTCHA or caching through custom PHP scripts.

Compromised websites also contain a malicious "verify" plugin that overlays the original content with a fake CAPTCHA for Windows visitors only. According to Jaromír Hořejší, the Check Point researcher who led the analysis, the attackers use custom PHP scripts to manage files uploaded to the WordPress sites, and those scripts also install the "verify" plugin. The plugin is activated after the attacker uploads a file called activator.php, and then it deletes itself. Hořejší told The Hacker News via email that the attacks target only Windows users, while visitors on Apple macOS or Linux are not affected. He also said that based on file timestamps from one compromised website, the secure upload script was likely uploaded first, and the other scripts were probably uploaded as backups so that if some were discovered and deleted, the attackers would still retain access.

As of July 24, 2026, the campaign had compromised more than 6,000 unique IP addresses, the numeric labels that identify devices on the internet. The largest shares were in the United States with 1,852, Russia with 630, and India with 630. Check Point's Eli Smadja summarized the risk, saying that StopAndProtect shows how attackers can turn thousands of poorly maintained WordPress sites into a distributed criminal infrastructure for malware delivery, surveillance, data theft, and ransomware. The company urges organizations to be cautious of unexpected CAPTCHA prompts that ask users to copy, paste, or run commands, to keep devices and security software updated, and to leave any website that asks for unusual steps outside the browser. For website owners, reducing the chance of becoming part of such infrastructure starts with keeping WordPress core and plugins current; managed WordPress hosting such as AEU Hosting includes update and hardening work as part of the service, which makes that upkeep easier.