Loading story…
Check Point Research uncovered StopAndProtect, a large-scale cybercrime operation that used compromised WordPress sites to host malware, provide command-and-control, and store stolen data. The campaign began with a ClickFix fake CAPTCHA lure that tricked victims into launching PowerShell, then deployed multiple .NET loader stages that installed a broad toolset including SilentEncryptor ransomware, the SilentDataCollector stealer, an SMB/USB worm, a VBS spreader, a lock-screen module, a credential stealer, and a custom chat utility for interacting with victims.
Researchers said the operators made significant OPSEC mistakes that exposed their infrastructure, including open PHP directory listings, accessible log and screenshot folders, and archived files that appeared to show the actors had infected themselves. Those leaks revealed source code and operational files used to mass-manage compromised WordPress domains. Monitoring from mid-May through late July 2026 found more than 700 stolen-data archives and about 31,000 victim screenshots, while internal logs and exposed systems indicated the campaign hit thousands of IP addresses worldwide, with the highest concentrations in the United States, Russia, and India.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
Stairwell authored the SilentEncryptor_Ransomware_HiFi YARA rule using three analyzed SilentEncryptor samples, detecting characteristic ransomware strings, cryptocurrency-wallet paths, and ransom-content markup. Its behavior- and characteristic-based hunting identified 22 related file variants assessed as consistent with StopAndProtect ransomware.
The Gurucul report published domains, SHA-256 hashes, and detection queries associated with the StopAndProtect campaign to help defenders identify related activity. The technical details accompanied reporting that the operation abused nearly 2,000 vulnerable WordPress sites for malware hosting, command-and-control, and victim log exfiltration.
Internal logs recovered from the exposed StopAndProtect infrastructure indicated more than 6,000 unique victim IP addresses. The highest concentrations of victims were in the United States, Russia, and India.
Between mid-May and the end of July 2026, researchers retrieved more than 700 archives of stolen victim data from compromised WordPress servers. The archives reflected theft of documents, password files, wallet files, file listings, encryption logs, screenshots, and progress logs.
Between mid-May and the end of July 2026, researchers collected about 31,000 victim screenshots from exposed directories on compromised WordPress servers. The screenshots included startup, activity, lock screen, and final images from infected systems.
Check Point Research first noticed the StopAndProtect ransomware family in the middle of May 2026. The operation combined ransomware, data theft, lateral movement, and tooling for interacting with victims.
Researchers found an exfiltrated archive that they believe resulted from the threat actor infecting themselves. It exposed internal project names, source code, a Visual Basic 6 tool for mass-managing compromised WordPress sites, and lists of roughly 1,400 domains still showing fake CAPTCHA ClickFix pages.
Researchers retrieved a ZIP archive from a hacked server containing mu-uploader-installer.php, which installed a persistent must-use plugin at wp-content/mu-plugins/wp-sec.php. The plugin created a hidden REST API upload endpoint with hardcoded credentials that could upload files, including PHP files, to nearly any path under the WordPress root.
During their investigation, researchers found exposed PHP scripts, open directory listings, and password-protected utilities on hacked WordPress sites used by the operation. These findings revealed malware hosting, command-and-control, and stolen-data storage infrastructure tied to StopAndProtect.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 53 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
9 references tracked. Mallory keeps watching after this page renders.
stairwell.com
Open sourcecommunity.gurucul.com
Open sourcesecurityaffairs.com
Open sourcecyberveille.ch
Open sourcecyberveille.ch
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourceitsecurityguru.org
Open sourceresearch.checkpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors covertly compromised **250+ legitimate WordPress websites**—including small businesses, regional media outlets, and at least one **U.S. Senate candidate** campaign site—and used them as distribution points for an **infostealer** operation. Rapid7 reported that attackers injected malicious code into the compromised sites to display a convincing **fake Cloudflare CAPTCHA** page that instructs visitors to **copy and execute a command** on their own machines, leveraging the **ClickFix** social-engineering technique to initiate malware delivery. Once executed, the malicious command leads to installation of credential-stealing malware capable of exfiltrating **browser-stored credentials**, **authentication cookies**, and **cryptocurrency wallet data**, with stolen “logs” potentially monetized on cybercrime forums. Reporting indicates the campaign has been active since **December** and shows signs of **high automation** across unrelated WordPress instances; Rapid7 also noted attacker-controlled domains used in the operation were registered around **July–August**, and the firm said it **notified U.S. authorities** to support investigation and remediation.
Jul 1, 2026
Researchers reported mass compromises of legitimate WordPress sites that use injected or rogue must-use plugins to deliver ClickFix-based malware chains. The malicious JavaScript registers browser Service Workers that can persist beyond site cleanup, remove Content Security Policy headers, and inject further scripts. Payload-stage code is retrieved through **EtherHiding** from mutable smart contracts—reported on Ethereum Sepolia, Ethereum mainnet, and Base—using encrypted browser payloads and fake reCAPTCHA lures to steer victims into executing malicious Windows actions. One observed chain downloads a Python-based RAT masquerading as `IntelSoftwareUpdaterV8.exe`, creates a hidden scheduled task, and uses UDP/53 traffic resembling Microsoft DNS for command-and-control. A separate nine-layer chain delivers the **Amatera** password stealer through an MP3/HTA polyglot, fileless AMSI-bypassing PowerShell, the Emmenhtal loader, reflective in-memory execution, steganographic payload concealment, and DNS-over-HTTPS. Organizations operating WordPress sites should investigate for unauthorized plugins and injected JavaScript, explicitly unregister malicious Service Workers during remediation, block identified infrastructure, and monitor the implicated smart contracts for payload rotation.
Aug 27, 2026
Threat actors used compromised legitimate websites—especially **WordPress** sites—to display fake CAPTCHA or browser-verification prompts that trick visitors into manually running malicious commands, resulting in information-stealer infections. Kroll reported that the **CLEARFAKE** campaign evolved from fake browser updates to a **ClickFix-style** technique in which victims copy, paste, and execute malicious PowerShell, while CyberCX linked a similar **DarkEngine** operation to at least **2,353** likely compromised WordPress sites after attackers allegedly stole administrator credentials through SEO-poisoned phishing pages and fake **WP Engine** logins. The campaigns relied on injected JavaScript and increasingly evasive delivery methods, including **EtherHiding**, which retrieves attacker-controlled code from the **BNB Smart Chain** through blockchain-related endpoints. Observed payloads decoded obfuscated content, downloaded follow-on malware, and performed discovery and credential theft, while NJCCIC said related ClickFix activity installed **MonsterV2** and could also deliver **StealC** or **Rhadamanthys**. Stolen data included browser information, account credentials, cryptocurrency wallets, and other sensitive personal information, showing how fake verification prompts on trusted sites are being used as an effective malware-delivery channel.
Aug 15, 2026