StopAndProtect Malware Uses Nearly 2,000 Hacked WordPress Sites

Security researchers at Check Point Research have uncovered a large-scale cybercrime operation named StopAndProtect that uses close to 2,000 hacked WordPress websites as infrastructure to spread malware, steal documents, and deploy ransomware. WordPress is a widely used free software for building and managing websites. The company first flagged a ransomware family with the same name in mid-May 2026, and later found that the operation relies on a whole toolkit of malicious software working together rather than a single piece of malware. Jaromír Hořejší, a researcher at Check Point Research, said the toolkit includes components that encrypt files, silently steal documents, lock the screen, and even provide a live chat between attackers and victims.

The infection starts with a ClickFix social engineering attack, a fake prompt that tricks visitors into copying and running a command. In this campaign, compromised WordPress sites show a fake CAPTCHA to Windows visitors. When a visitor follows the instruction, a Windows PowerShell command runs, which is a built-in Windows tool for running automated commands and scripts. That command then loads a series of additional components. Check Point Research describes a multi-step process: a first-stage .NET downloader reports statistics to a command-and-control (C2) server, which is a server attackers use to send instructions to infected computers, and loads the next stage; a second-stage downloader and loader performs checks to avoid analysis sandboxes and adds more logging before launching the main components; and a third stage contains six separate components.

The six third-stage components each have a specific role. SilentEncryptor encrypts files on infected computers, either all currently infected devices or only those with given host names. NetworkShareScanner works like a worm that spreads over network shares and USB drives. A VBS spreader propagates malware to hard disks and removable media, scans the network, and moves laterally using Windows Management Instrumentation (WMI). LockScreen blocks user input and displays a ransom message with a payment QR code. SimpleChatProxy is a custom chat application that lets the victim and the operator communicate. SilentDataCollector creates a list of all drives, encrypts it, and sends it to the command-and-control server; the operator can upload a command file that tells the stealer which specific files to collect. Newer versions of the stealer add a keylogger, software that records every key a user presses, with valid email address detection, exfiltration from WhatsApp, mapping and unmapping of network shares, and screenshots of user activity every 30 seconds. Check Point said an operator can issue a WhatsApp search keyword, and the stealer waits until the victim is inactive, then uses WhatsApp automation to focus the search box, enter the keyword, open the contact information, and capture a screenshot.

To convert a legitimate WordPress website into part of the criminal infrastructure, the attackers use a ZIP archive that contains a PHP file named uploader-installer.php. That file installs a custom WordPress plugin, an add-on that extends WordPress features, which then creates a must-use (MU) plugin file inside the wp-content/mu-plugins directory. The plugin lets anyone with valid credentials upload arbitrary files, including PHP files, to almost any path under the WordPress root, which can lead to remote code execution, a security weakness that lets an attacker run their own code on the website. Once the site has been tampered with, the plugin deactivates itself and self-deletes to avoid detection. The malicious files uploaded through this mechanism include stolen data from victim machines, with more than 700 archives identified from mid-May to the end of July 2026. Among those files are internal development files and tools that appear to come from the operator accidentally infecting themselves, including a custom automation utility named fMain.frm used to mass-manage compromised WordPress sites. Check Point said this automation tool lets the botnet operator, the person who controls the network of infected machines, upload or delete files, activate or deactivate the fake CAPTCHA, and activate or deactivate caching on compromised sites. The compromised sites also contain a malicious verification plugin called verify that overlays the original content with a fake CAPTCHA for Windows visitors. The plugin is activated after the attacker uploads a file named activator.php, after which it deletes itself. Jaromír Hořejší told The Hacker News that the attackers use custom PHP scripts to manage files uploaded to the WordPress sites, and that the file management script also installs the verify plugin. The attacks are designed to target only Windows users; visitors using Apple macOS or Linux are not affected.

Check Point said it was able to learn more about the campaign because of operational security mistakes that exposed detailed infection logs, screenshots from victim machines, and the tools used to mass-manage compromised websites. Most of the hacked sites run outdated versions of WordPress and installed plugins; one compromised website runs a WordPress version from 2021 that is susceptible to roughly 40 different vulnerabilities. As of July 24, 2026, the campaign had compromised more than 6,000 unique IP addresses. Most of those are located in the United States (1,852), Russia (630), and India (630). In a statement, Check Point's Eli Smadja said StopAndProtect demonstrates how attackers can turn thousands of poorly maintained WordPress sites into distributed criminal infrastructure for malware delivery, surveillance, data theft, and ransomware. The company urges organizations to be cautious of unexpected CAPTCHA prompts that instruct them to copy, paste, or run commands, keep devices and security software updated, and immediately leave any website that asks them to perform unusual steps outside the browser. For website owners, keeping WordPress and all plugins up to date is essential, and a managed WordPress hosting service such as AEU Hosting provides secured end-to-end hosting that can reduce the chance that a site becomes a hijacked host.