Hackers Turn Thousands of WordPress Sites Into StopAndProtect Malware Infrastructure

A newly uncovered cybercrime operation, dubbed StopAndProtect, has transformed thousands of compromised WordPress websites into a distributed infrastructure for malware delivery, command-and-control communications, and the storage of stolen data.

Checkpoint first observed the campaign in mid-May 2026 and found that it blends ransomware activity with targeted data theft, enabling operators to decide whether to encrypt victims’ files, silently collect documents, or do both.

The campaign begins with a ClickFix social-engineering lure hosted on hacked websites. Visitors are shown a fake CAPTCHA prompt that instructs them to copy and run a PowerShell command.

Hackers Turn Thousands of WordPress Sites

Once executed, the command launches a hidden PowerShell process, downloads additional payloads, and starts a multi-stage infection chain. The sequence progresses from PowerShell scripts to .NET loaders, then deploys functional malware modules onto the victim’s system.

StopAndProtect’s malware toolkit includes a ransomware component known as SilentEncryptor, a credential and data stealer called SilentDataCollector, a lock-screen payload, a custom chat tool, and propagation components capable of moving through SMB shares, USB devices, WMI, and removable media.

This modular design gives the attackers flexibility. Rather than automatically encrypting every infected endpoint, operators can collect file inventories, select high-value documents, exfiltrate them, and later trigger encryption on chosen machines.

Compromised WordPress sites are central to every stage of the operation. The attackers use them to host PowerShell scripts and .NET payloads, issue commands to infected hosts, receive telemetry, and store exfiltrated archives containing documents, browser-related data, screenshots, encryption logs, and lists of files on victim systems.

Jaromír Hořejší observed more than 700 stolen-data archives and approximately 31,000 screenshots collected between mid-May and late July 2026.

Operational-security mistakes exposed the campaign’s scale. One compromised server contained publicly accessible directory listings, revealing malware samples, logs, victim screenshots, and custom PHP utilities.

Other infected WordPress sites hosted password-protected file managers, uploaders, and deletion tools that helped operators maintain their infrastructure.

These utilities allowed the group to upload new payloads, remove artifacts, and manage malicious content across hacked websites without needing direct administrative access through the normal WordPress interface.

A particularly significant discovery was a malicious must-use WordPress plugin installer. After activation, it created a hidden plugin under the wp-content/mu-plugins directory and exposed a concealed REST API upload endpoint.

Because must-use plugins automatically load on every request and generally do not appear in the standard WordPress Plugins interface, they provide attackers with durable persistence.

The backdoor could upload PHP files to locations under the WordPress root, potentially enabling remote code execution. The attackers’ own apparent self-infection also exposed internal tooling.

An archive included source code and domain lists linked to a Visual Basic 6 application used to mass-manage compromised WordPress sites.

The tool reportedly handled payload uploads, fake CAPTCHA activation, cache manipulation, and file removal. Internal lists referenced close to 2,000 compromised domains, indicating that the infrastructure was built for scale.

Campaign logs identified more than 6,000 unique IP addresses, with the largest concentrations in the United States, Russia, and India.

StopAndProtect demonstrates how neglected WordPress installations and vulnerable plugins can become both initial-access vectors and resilient criminal infrastructure.

Website owners should urgently patch WordPress core and plugins, audit must-use plugin directories, review unexpected REST endpoints, and investigate unfamiliar PHP files, upload utilities, and CAPTCHA overlays.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN