Cybersecurity experts have uncovered a sophisticated cybercrime campaign, StopAndProtect, which leverages nearly 2,000 compromised WordPress websites to distribute malware globally. This operation, identified by Check Point Research, exploits these sites for various malicious purposes, including data theft and ransomware deployment.
Complex Toolkit of Cyber Threats
The StopAndProtect operation is not limited to a single malware type; it utilizes a comprehensive toolkit of criminal software. This includes components that encrypt files, steal sensitive documents, and even facilitate live communication between attackers and victims. The campaign, tracked since mid-May 2026, initiates with a deceptive ClickFix social engineering tactic.
This initial attack triggers a PowerShell command, which in turn deploys additional .NET downloaders and loaders. These loaders pave the way for critical components such as ransomware, SMB/USB worms, LockScreen, and credential stealers. While ransomware is not always the end goal, the operation often involves covert data theft.
Role of Compromised WordPress Sites
Hacked WordPress sites play a central role in this operation, serving multiple purposes. These sites host various malware stages, function as command-and-control servers for sending instructions, and store logs exfiltrated from victims. The vulnerability of these sites is exacerbated by outdated WordPress versions and plugins, making them easy targets for exploitation.
Visitors to these sites encounter fake CAPTCHA prompts, which, when engaged, initiate a multi-step infection process. The PowerShell command involved acts as a conduit for malware deployment, involving several stages and components that execute diverse malicious activities.
Operational Security and Prevention
Check Point’s investigation revealed operational security lapses by the threat actors, providing deeper insights into the campaign. The compromised sites contain PHP files that allow remote code execution, leading to widespread malware proliferation. Moreover, the campaign has affected over 6,000 unique IP addresses, with significant impacts in the U.S., Russia, and India.
Organizations are advised to be wary of unexpected CAPTCHA prompts and maintain updated security measures to mitigate risks. Check Point emphasizes the importance of vigilance and immediate disengagement from suspicious websites to prevent falling victim to such cyber threats.
Ultimately, the StopAndProtect campaign highlights the need for robust cybersecurity practices and the dangers posed by neglected website maintenance. As cybercriminals continue to evolve their tactics, staying informed and prepared is crucial for safeguarding digital assets.
