Cybersecurity researchers have flagged a large criminal operation that leverages hacked WordPress sites to deliver malware, collect stolen files, and coordinate attacks at scale. The campaign, tracked under the name StopAndProtect, was discovered after investigators identified a ransomware family of the same name and mapped an infection process that repeatedly funnels victims through multiple stages.
What makes the effort particularly worrying is its use of compromised sites not only as staging areas, but also as command-and-control infrastructure. In other words, the attackers did not treat WordPress servers as a side target; they built them into the operational backbone of the campaign.
How StopAndProtect abuses hacked WordPress sites
According to Check Point Research, the operation is supported by a cluster of compromised websites that perform several roles:
- They host malware stages that are delivered to victims.
- They act as command-and-control (C2) servers, sending instructions to infected systems.
- They store exfiltrated logs and other material taken from victims.
Researchers estimate that nearly 2,000 WordPress sites were hacked as part of this campaign. Many of the affected sites were running outdated WordPress versions and had additional plugins installed, expanding the number of possible entry points and weaknesses attackers could exploit.
The infection starts with ClickFix-style social engineering
The threat chain begins with a social engineering approach resembling a ClickFix prompt. Visitors are presented with a fake CAPTCHA-style experience, designed to trick them into executing actions that help the attackers gain a foothold.
Once the user follows the prompt, the site triggers a PowerShell command. That command then leads to the deployment of additional components—initially .NET downloaders and loaders—which set up the later payloads used for stealing, surveillance, and possible encryption.
A toolkit of staged components
StopAndProtect does not rely on a single malware. Instead, it combines multiple pieces of criminal software that work together. Some components can encrypt files, while others focus on silent collection such as documents, activity information, and screenshots. Another module provides a communication channel between attackers and victims.
Importantly, ransomware is not guaranteed. Researchers noted that the operation sometimes stays in covert theft mode, quietly extracting files and file lists rather than encrypting systems.
Stage overview: from downloaders to ransomware and beyond
The campaign includes a multi-step staging process. Investigators described three broad stages:
- Stage 1: a .NET downloader that reports statistics to the C2 server and loads the next stage.
- Stage 2: a second .NET downloader/loader that performs checks (including sandbox-related logic) and adds logging before launching the main components.
- Stage 3: a set of six key components.
The six stage-3 components include:
- SilentEncryptor, which encrypts either selected infected computers or all infected systems depending on host naming.
- NetworkShareScanner, behaving like an SMB/USB worm to spread to additional devices.
- VBS spreader, which propagates to hard disks and removable media, scans the network, and moves laterally via WMI.
- LockScreen, which blocks user input and shows a ransom message with a payment QR code.
- SimpleChatProxy, a custom chat utility used for victim-operator communication.
- SilentDataCollector, which inventories drives, encrypts that list, and exfiltrates it to the C2 server. Operators can upload a command file to specify which files to harvest.
This design reflects a “mix-and-match” approach. Even when encryption is available, the operator can prioritize theft and surveillance depending on their objectives and the access level obtained.
Newer features: keylogging, WhatsApp targeting, and frequent screenshots
Researchers also observed enhancements in later iterations of the data-collection functionality. Beyond harvesting documents and lists, the stealer can add:
- A keylogger that includes email address detection.
- Exfiltration from WhatsApp, including support for both web and desktop versions.
- Network share mapping and unmapping.
- Screenshot capture at a regular cadence (every 30 seconds).
The WhatsApp targeting process is automated. The attacker can provide a keyword for search; the malware waits until the victim is inactive, then focuses the search box, inputs the keyword (such as a contact name), opens contact information, and captures a screenshot.
Turning WordPress into delivery infrastructure
To understand how the WordPress sites became part of this operational chain, investigators examined how the attackers installed a custom WordPress plugin. They found a ZIP archive containing a PHP uploader/installer file used to place the plugin into WordPress in a way that enables persistent behavior.
In particular, attackers used the must-use plugin mechanism (MU plugins). The custom plugin supports uploading arbitrary files to the WordPress environment when valid credentials are available. With this ability, attackers could upload PHP files—potentially enabling remote code execution—into many locations under the WordPress root.
After deploying the payloads, the plugin deactivates itself and self-deletes to reduce the chance of detection.
Self-management automation and hiding evidence
Compromised sites included a malicious “verify” plugin that overlays the original content with a fake CAPTCHA prompt for non-Windows visitors. Researchers also observed that this plugin is activated after the attackers upload a separate activator file, after which the activator removes itself.
Further investigation suggested the operators used an automation utility stored on the compromised infrastructure to mass-manage infected WordPress pages. The tool reportedly uses secure PHP scripts to upload and delete files, toggle fake-CAPTCHA behavior, and change caching settings across multiple sites.
Investigators even identified archives that appear to be the attackers infecting themselves, including internal development materials and the automation tooling used for managing compromised WordPress instances.
Geography and scale of the compromised infrastructure
As of July 24, 2026, the operation had compromised more than 6,000 unique IP addresses. The majority were located in the U.S. (1,852), Russia (630), and India (630).
From an operational standpoint, this geographic spread aligns with the campaign’s reliance on hacked WordPress sites as distributed infrastructure for malware delivery, surveillance, data theft, and, in some cases, ransomware.
What organizations can do if they see suspicious CAPTCHA prompts
StopAndProtect highlights how quickly attackers can turn poorly maintained content management systems into a criminal platform. Researchers urged organizations and users to be alert for unexpected CAPTCHA prompts that request unusual steps.
Practically, the recommendations include:
- Be cautious of CAPTCHAs or prompts that instruct you to copy, paste, or run commands—especially outside a normal browser flow.
- Keep WordPress, themes, plugins, and all related security software updated.
- If a website prompts unusual actions, leave the site immediately rather than following instructions.
For defenders managing WordPress environments, the case also reinforces the value of monitoring for suspicious plugin changes, unexpected file uploads, and abnormal visitor prompts—especially on sites running outdated software.
Conclusion
The StopAndProtect campaign shows how hacked WordPress sites can be repurposed into a distributed criminal infrastructure. By combining ClickFix-style social engineering with staged .NET payloads, attackers can steal data, capture screenshots, automate messaging-related targeting, and—depending on the scenario—deploy ransomware or keep systems in a stealthy theft mode.
Staying protected requires vigilance from users and disciplined patching and monitoring from administrators. When a website asks for unexpected steps that go beyond the browser, treating it as a potential threat—and responding quickly—can reduce the risk of compromise.
Source: https://thehackernews.com/2026/08/stopandprotect-uses-nearly-2000-hacked.html
