Skip to content

StopAndProtect: ~2,000 hacked WordPress sites powering distributed malware, data theft, and ransomware

Summary

Check Point Research is tracking a global cybercrime operation under the moniker StopAndProtect after discovering a ransomware family of the same name in mid-May 2026. The operation abuses a cluster of close to 2,000 hacked WordPress websites as infrastructure to disseminate malware, commandeer infected hosts, and store stolen documents, screenshots, and activity logs. Check Point says the operator's operational-security blunders (exposed infection logs, victim screenshots, and mass-management tooling on the compromised sites) gave it visibility into the campaign.

"The operation doesn't rely on a single piece of malware, but on a whole toolkit of criminal software working together – some components encrypt files, others silently steal documents or lock the screen, and another acts as a live chat between the attackers and their victims," said Check Point Research's Jaromír Hořejší.

Tags

Infection chain

  1. ClickFix social engineering — a fake CAPTCHA overlay on a compromised WordPress site (shown to non-Windows visitors via a malicious "verify" plugin) instructs the visitor to copy-paste a command.
  2. PowerShell execution — the pasted command deploys .NET downloaders and loaders.
  3. Main components — ransomware, SMB/USB worm, LockScreen, VBS spreader, a live attacker-victim chat utility, and a credential stealer.

Notably, the operation does not always deploy ransomware. In most cases the actors covertly steal lists of files and then specific files — data theft is the common outcome, with ransomware as one of several available options.

WordPress infrastructure

  • ~2,000 hacked WordPress sites estimated; most run outdated WordPress versions and vulnerable plugins.
  • 700+ archives of stolen data identified from mid-May to end of July 2026 on the compromised sites, including internal development files and tools — including the operator's own tooling, suggesting a self-infection incident (a custom automation utility, fMain.frm, used to mass-manage compromised WordPress pages: secure upload/delete PHP scripts, fake-CAPTCHA ClickFix activation, caching toggles).
  • A malicious "verify" plugin overlays original content with a fake CAPTCHA for non-Windows visitors; it is activated after the actor uploads activator.php, which then deletes itself.
  • A must-use (MU) plugin dropped into wp-content/mu-plugins lets anyone with valid credentials upload arbitrary files, including PHP, to almost any path under the WordPress root — paving the way for RCE on the site. The plugin deactivates and self-deletes to evade detection.
  • As of July 24, 2026 the campaign had compromised more than 6,000 unique IP addresses, most in the U.S. (1,852), Russia (630), and India (630).

Why this matters

  • This is WordPress-as-offensive-infrastructure at scale: thousands of low-maintenance sites become a distributed, deniable platform for malware delivery, victim management, and data staging — and the same sites simultaneously act as the delivery mechanism (fake CAPTCHA ClickFix).
  • The exposed operator tooling (fMain.frm, upload/delete scripts) is a reusable detection source: the exact filenames, plugin names, and self-deletion behaviors are concrete IOCs.
  • ClickFix via a fake CAPTCHA on a public website is a low-sophistication, high-reach initial-access vector that endpoint defenses rarely challenge.

Defender priorities

  1. End users: be cautious of unexpected CAPTCHA prompts that instruct you to copy, paste, or run commands; leave any site asking for unusual out-of-browser steps.
  2. WordPress operators: keep core + plugins current, audit wp-content/mu-plugins for unexplained must-use plugins, and look for activator.php, the "verify" plugin, and the self-deleting plugin patterns described above.
  3. Hunt for the ClickFix variant: website-served fake CAPTCHA overlays targeting non-Windows visitors with a PowerShell copy-paste instruction.
  4. Detect the .NET downloaders/loaders that follow the pasted PowerShell command, plus the downstream components (SMB/USB worm, LockScreen, VBS spreader, chat utility, credential stealer).
  5. Assume data theft even without ransom: the common outcome is file-list-then-file exfiltration to the compromised WordPress sites; exfil-stage alerting matters.
  6. Watch for self-infection / OPSEC artifacts on hosting providers — the operator's own tools were uploaded to victim infrastructure, a recurring theme in large WordPress botnets.

Assessment limits

  • Site counts (~2,000), archive counts (700+), and victim IP counts (6,000+) are Check Point's estimates from its telemetry as of July 24, 2026; the campaign is likely still active and growing.
  • No named threat actor is attributed; "StopAndProtect" is Check Point's tracking name for the operation and its ransomware family.

Sources