Cybersecurity researchers have uncovered a global cybercrime operation that exploits thousands of hacked **WordPress** websites as a distributed infrastructure to disseminate malware, commandeer infected hosts, and store stolen documents, screenshots, and activity logs. "The operation doesn't rely on a single piece of malware, but on a whole toolkit of criminal software working together – some components encrypt files, others silently steal documents or lock the screen, and another acts as a live chat between the attackers and their victims," stated **Jaromír Hořejší** of **Check Point Research**.  ### The StopAndProtect Campaign Unveiled The large-scale campaign, tracked as **StopAndProtect**, was identified following the discovery of a ransomware family of the same name in mid-May 2026. The infection sequence typically begins with a **ClickFix** social engineering attack, leading to the execution of a PowerShell command that deploys additional .NET downloaders and loaders. This sophisticated initial access then paves the way for the main components, including ransomware, an SMB/USB worm, LockScreen functionality, a VBS spreader, a chat utility, and a credential stealer. Notably, not all infections culminate in ransomware deployment; in many instances, threat actors are observed covertly exfiltrating file lists and specific documents from compromised systems. ### Hacked WordPress Sites: A Multi-Functional Infrastructure The backbone of the **StopAndProtect** operation is a cluster of compromised **WordPress** sites, serving several critical functions: * **Hosting malware stages:** These sites act as repositories for various components of the malware toolkit. * **Command-and-Control (C2) servers:** They send instructions to infected hosts. * **Storing exfiltrated logs:** Victim data, including activity logs, is stored on these compromised sites. **Check Point** gained significant insight into the campaign due to operational security oversights by the threat actors, which exposed detailed infection logs, screenshots from victim machines, and tools used to manage the compromised websites. An estimated 2,000 **WordPress** sites have been hacked as part of this campaign. Most of these sites run outdated versions of **WordPress** and its plugins. For example, one compromised site still uses a **WordPress** version from 2021, making it vulnerable to approximately 40 known exploits.  ### The Infection Chain: From CAPTCHA to Ransomware The compromised sites are tampered with to display fake **ClickFix**-style CAPTCHA prompts to visitors, initiating the infection process. The PowerShell command triggered by these prompts facilitates a multi-stage deployment: 1. **Stage 1 .NET downloader:** Reports statistics to the C2 server and loads the subsequent stage. 2. **Stage 2 .NET downloader and loader:** Incorporates sandbox checks, additional logging, and launches the primary malware components. 3. **Stage 3 components:** This stage includes a suite of six tools: * **SilentEncryptor:** Encrypts files on infected computers, either broadly or targeting specific hostnames. * **NetworkShareScanner:** Functions as an SMB/USB worm to propagate to other devices. * **VBS spreader:** Distributes malware to hard disks and removable media, scans networks, and moves laterally via WMI. * **LockScreen:** Blocks user input and displays a ransom message with a payment QR code. * **SimpleChatProxy:** A custom chat application for direct communication between the victim and the operator. * **SilentDataCollector:** Generates a list of all drives, encrypts it, and exfiltrates it to the C2 server. Operators can then upload command files to harvest specific data. Newer iterations of the stealer further enhance capabilities, including a keylogger with valid email address detection, exfiltration from **WhatsApp**, mapping and unmapping network shares, and capturing screenshots of user activity every 30 seconds. "An operator may issue a **WhatsApp** search keyword; both the web and desktop versions are supported," **Check Point** noted. "The stealer waits until the victim becomes inactive and then uses **WhatsApp** automation to focus the search box, enter the specified keyword (contact name), open the contact information, and capture a screenshot." ### Operational Blunders and Management Tools Further investigation revealed that the threat actors utilize a ZIP archive containing a PHP file ("uploader-installer.php") to install a custom **WordPress** plugin. This plugin creates a must-use (**MU**) plugin file in the "wp-content/mu-plugins" directory. This custom plugin allows anyone with valid credentials to upload arbitrary files, including PHP files, to almost any path under the **WordPress** root, potentially leading to remote code execution. After interference, the plugin deactivates and self-deletes to evade detection. The uploaded files include stolen data from victim machines, with over 700 archives identified between mid-May and late July 2026. Among these files were internal development files and tools, suggesting the operator inadvertently infected themselves. This included a custom automation utility named "fMain.frm" used to manage the compromised **WordPress** sites. "This automation tool allows the botnet operator to mass-manage compromised **WordPress** pages," **Check Point** explained. "It uses secure upload and delete PHP scripts on compromised websites to upload or delete additional files, activate or deactivate fake-captcha **ClickFix**, activate or deactivate caching, etc." The compromised sites contain a malicious "verify" plugin that overlays the original content with a fake CAPTCHA for **Windows** visitors. This plugin is activated after the threat actor uploads an "activator.php" file, subsequently deleting itself. **Hořejší** confirmed that custom PHP scripts are used to manage files uploaded to the **WordPress** sites and facilitate the installation of the "verify" plugin. The attacks exclusively target **Windows** users; **Apple macOS** or **Linux** users visiting the sites are unaffected. "Based on the file timestamps from one of the compromised websites, we assume that the secure upload script was uploaded first, while the other scripts were likely uploaded as backups," **Hořejší** added. "This way, if one or two of them were discovered and deleted, the attackers would still retain access to the compromised websites." As of July 24, 2026, the campaign has compromised over 6,000 unique IP addresses, with the majority located in the U.S. (1,852), Russia (630), and India (630). **Eli Smadja** of **Check Point** emphasized, "**StopAndProtect** shows how attackers can turn thousands of poorly maintained **WordPress** sites into a distributed criminal infrastructure for malware delivery, surveillance, data theft, and ransomware." Organizations are urged to exercise caution regarding unexpected CAPTCHA prompts that demand copying, pasting, or running commands. Keeping devices and security software updated, and immediately exiting any website requesting unusual steps outside the browser, are crucial preventative measures.