2,000 WordPress sites hijacked by StopAndProtect malware operation

A large-scale malware operation dubbed StopAndProtect uses thousands of compromised WordPress websites to distribute malware, issue commands, and store data stolen from infected computers.

The campaign combines ransomware, credential theft, surveillance, lateral movement, and hands-on data collection, with logs revealing more than 6,000 unique IP addresses linked to infections.

The operation was discovered by Check Point Research analyst Jaromír Hořejší, who first encountered the StopAndProtect ransomware family in mid-May 2026. Further investigation found that the ransomware was only one component of a much broader toolkit and that attackers sometimes chose to steal files without encrypting the victim's system.

StopAndProtect infections begin when visitors to compromised WordPress sites encounter a fake CAPTCHA using the ClickFix social-engineering technique. The page copies a malicious PowerShell command to the clipboard and instructs victims to execute it. That command launches a multi-stage infection chain involving two PowerShell scripts, two .NET downloaders and loaders, and a final set of specialized payloads.

The attackers use compromised WordPress servers throughout the operation. The sites host payloads, act as command-and-control servers, receive infection telemetry, and store screenshots, logs, and stolen documents.

Poor operational security provided researchers with an unusually detailed view of the campaign. One exposed PHP endpoint, dwnen.php, displayed server directory contents, leading researchers to additional malware samples and victim data. Between mid-May and late July, Check Point collected roughly 31,000 screenshots uploaded from infected computers and more than 700 archives containing stolen files.

Another exposed archive appeared to come from the attacker's own computer, possibly after an accidental self-infection. It contained source code for a Visual Basic 6 tool used to manage compromised WordPress sites in bulk, along with text files identifying close to 2,000 domains. One list alone contained roughly 1,400 sites associated with the fake CAPTCHA infrastructure.

The malware toolkit includes SilentEncryptor, which encrypts files; SilentDataCollector, which steals selected documents and records screenshots; an SMB and USB worm; a VBS-based spreader capable of WMI lateral movement; a lock-screen component; and SimpleChatProxy, which allows attackers to communicate directly with victims.

Newer versions of the data stealer also contain a keylogger, WhatsApp contact harvesting, network-share management, and screenshot capture every 30 seconds while the victim is active. Operators can remotely specify files or WhatsApp contacts they want the malware to locate.

Check Point counted more than 6,000 unique IP addresses in campaign logs as of July 24, including 1,852 in the United States and 630 each in Russia and India.

WordPress administrators should keep the CMS and all plugins updated, remove abandoned extensions, and inspect wp-content/mu-plugins for unexpected files. Users should also treat CAPTCHA pages asking them to paste or execute PowerShell commands as malicious and close the site without running the supplied instructions.