StopAndProtect Malware Hijacks 2,000 WordPress Sites in Global Campaign

Cybersecurity researchers at Check Point Research have uncovered a sprawling global cybercrime operation, dubbed StopAndProtect, that weaponizes nearly 2,000 compromised WordPress websites to distribute malware, host command-and-control (C2) infrastructure, and exfiltrate stolen files. The campaign was first identified in mid-May 2026 following the discovery of a ransomware family bearing the same name. According to researcher Jaromír Hořejší, the operation relies not on a single payload but on a coordinated toolkit — including file encryptors, LockScreen modules, SMB/USB worms, VBS spreaders, credential stealers, and a live-chat utility used by operators to negotiate with victims.

The infection chain begins with a ClickFix social engineering lure served from tampered WordPress sites, which prompts visitors to run a malicious PowerShell command under the guise of a CAPTCHA verification. That command triggers a staged deployment: a stage 1 .NET downloader that beacons to the C2 and pulls the next payload; a stage 2 .NET loader with sandbox-evasion checks and enhanced logging; and finally a stage 3 module set featuring SilentEncryptor (which selectively encrypts hosts based on machine name), NetworkShareScanner (an SMB/USB worm for lateral propagation), and a VBS-based spreader. Notably, the operators do not always deploy ransomware — in many incidents they quietly harvest document lists and targeted files from infected systems. Operators can also check whether their credentials or domains appear in known leaks via an email breach checker.

The hacked WordPress sites serve three core functions: hosting malware stages, acting as C2 servers to dispatch instructions, and storing logs, screenshots, and exfiltrated victim data. Check Point noted that most of the roughly 2,000 compromised sites run outdated WordPress core and plugins — one sample site runs a 2021-era WordPress build exposed to around 40 known vulnerabilities. Threat actors exploited these weaknesses to inject fake ClickFix CAPTCHA prompts that auto-infect returning visitors. Operational security lapses by the attackers, including exposed administrative panels and detailed infection logs, allowed researchers to map the full scope of the infrastructure. Defenders investigating suspicious domains tied to the campaign can use a WHOIS lookup to identify registrar patterns, while a port scanner can help uncover exposed services that may be acting as C2 endpoints.