{"id":2436,"date":"2026-08-19T12:04:32","date_gmt":"2026-08-19T12:04:32","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2436"},"modified":"2026-08-19T12:04:32","modified_gmt":"2026-08-19T12:04:32","slug":"stopandprotect-uses-nearly-2000-hacked-wordpress-sites-to-spread-malware-and-steal-data","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2436","title":{"rendered":"StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data"},"content":{"rendered":"<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiHtWFBMa_xYpIkK39I2gvAJrksqJBAkRSnEZ-WjwpQtbV9mgfPRzWp3qtdhk_v1yOG67pAZ5H3DAFRVv7rEzbns9IuAa4_DV-MUBDIb6fuWzLyRvFXyC1fOaTUPbwxdoY4cykbPy3wXEn3HvlnbjbqH37vkLKMSJA799pVeD50RqMGlJJztFJZcFzR2xTf\/s1700-e365\/wordpress-hacks.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>Cybersecurity researchers have flagged a global cybercrime operation that abuses thousands of hacked WordPress websites as infrastructure to disseminate malware, commandeer infected hosts, store stolen documents, screenshots, and activity logs created to track the status of the activity.<\/p>\n<p>\u00abThe operation doesn&#8217;t rely on a single piece of malware, but on a whole toolkit of criminal software working together \u2013 some components encrypt files, others silently steal documents or lock the screen, and another acts as a live chat between the attackers and their victims,\u00bb Check Point Research&#8217;s Jarom\u00edr Ho\u0159ej\u0161\u00ed <a href=\"https:\/\/research.checkpoint.com\/2026\/thousands-of-hacked-wordpress-sites-one-operation-unmasking-stopandprotect\/\" target=\"_blank\">said<\/a>.<\/p>\n<p>The large-scale campaign is being tracked by the cybersecurity company under the moniker <strong>StopAndProtect<\/strong> after discovering a ransomware family of the same name in mid-May 2026. The infection chain begins with a ClickFix social engineering attack, resulting in the execution of a PowerShell command that leads to the deployment of additional .NET downloaders and loaders.<\/p>\n<p>This subsequently gives way to the main components, including ransomware, SMB\/USB worm, LockScreen, VBS spreader, chat utility and credential stealer. That said, it&#8217;s worth noting that the operation does not always result in ransomware deployment. In most cases, the threat actors have been observed covertly stealing lists of files and then specific files from the systems.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/zero-trust-claude-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEj8iAp2j8rqTq6aptj6yiYHC-B73UxnWI2NQMt0azp6OVLq9JkO8cpYokLWa8t_IKqrHKPsaM5D_lQ9Ip7kZTi3at4oYfzN1m1b_T4b6MuzBWtmlhdLcQ0nZHicD94rliREFDRewsKBQCTYrAAVNzYKj84_0EZskDUxvkc972s9fYAqcQGEQjVZTc0cr7TB\/s728-e100\/ThreatLocker-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The operation is supported by a cluster of hacked WordPress sites that serve multiple functions &#8211;<\/p>\n<ul>\n<li>Host malware stages<\/li>\n<li>Run as command-and-control (C2) servers to send instructions<\/li>\n<li>Store logs exfiltrated from victims<\/li>\n<\/ul>\n<p>Check Point said it was able to glean more insights into the campaign due to the threat actor&#8217;s operational security blunders that exposed detailed infection logs and screenshots from victim machines, as well as the tools used to mass-manage compromised websites. As many as close to 2,000 WordPress sites are estimated to have been hacked as part of the campaign.<\/p>\n<p><a name=\"more\"\/><\/p>\n<p>Most of the sites have been found to not only run outdated versions of WordPress, but also installed plugins. One of the compromised websites, for instance, runs a WordPress version from 2021, making it susceptible to roughly 40 different vulnerabilities.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjj1hVGCCLqQiLDOu8IoktllJXd1Zir_zGQSssUZRbn_om59m7Qy6dHV8H6tDt1yunbII6thlyAX2gjO5JTz8myQhInmCfX0iurhAyqHCeQxSH1YcXij7ZO0aMfzf2BvnwEgnNn841fPw1ThBp7jfp74JuJ4wHJ9fWI2NypIeOBnHQIy3kp6PZWk83M8Wo0\/s1700-e365\/cp.png\" style=\"clear: left; display: block; float: left;  text-align: center;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjj1hVGCCLqQiLDOu8IoktllJXd1Zir_zGQSssUZRbn_om59m7Qy6dHV8H6tDt1yunbII6thlyAX2gjO5JTz8myQhInmCfX0iurhAyqHCeQxSH1YcXij7ZO0aMfzf2BvnwEgnNn841fPw1ThBp7jfp74JuJ4wHJ9fWI2NypIeOBnHQIy3kp6PZWk83M8Wo0\/s1700-e365\/cp.png\" alt=\"\" border=\"0\" data-original-height=\"579\" data-original-width=\"1024\"\/><\/a><\/div>\n<p>These sites are tampered with to serve fake ClickFix-style CAPTCHA prompts to visitors, effectively infecting themselves in the process. The PowerShell command triggered using this method acts as a conduit for a multi-step process &#8211;<\/p>\n<ul>\n<li>A stage 1 .NET downloader that reports statistics to the C2 server and loads the next stage<\/li>\n<li>A stage 2 .NET downloader and loader that incorporates sandbox checks and more logging mechanisms, and launches the main components<\/li>\n<li>\n    A stage 3 that includes six components:<\/p>\n<ul>\n<li><strong>SilentEncryptor<\/strong>, which encrypts either all currently infected computers or only computers with given host names<\/li>\n<li><strong>NetworkShareScanner<\/strong>, which functions like an SMB\/USB worm to spread to other devices<\/li>\n<li><strong>VBS spreader<\/strong>, which propagates the malware to hard disks and removable media, scans the network, and laterally moves via WMI<\/li>\n<li><strong>LockScreen<\/strong>, which blocks user input and displays a ransom message with a payment QR code)<\/li>\n<li><strong>SimpleChatProxy<\/strong>, which is a custom chat application for communicating between the victim and operator<\/li>\n<li><strong>SilentDataCollector<\/strong>, which generates a list of all drives, encrypts it, and exfiltrates this list to the C2 server. The operator can upload a command file to the server that the stealer reads to harvest specific files.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>Newer iterations of the stealer also implement extra features, including a keylogger with valid email address detection, exfiltration from WhatsApp, mapping and unmapping network shares, and capturing screenshots of user activity every 30 seconds.<\/p>\n<p>\u00abAn operator may issue a WhatsApp search keyword; both the web and desktop versions are supported,\u00bb Check Point said. \u00abThe stealer waits until the victim becomes inactive and then uses WhatsApp automation to focus the search box, enter the specified keyword (contact name), open the contact information, and capture a screenshot.\u00bb<\/p>\n<p>Further investigation has determined that the threat actors make use of a ZIP archive containing a PHP file (\u00abuploader-installer.php\u00bb) to install a custom WordPress plugin, which is used to create a must-use (MU) plugin file that&#8217;s responsible for creating a must-use (MU) plugin file in the \u00abwp-content\/mu-plugins\u00bb directory.<\/p>\n<p>The plugin lets anyone in possession of valid credentials upload arbitrary files, including PHP files, to the WordPress site to almost any path under the WordPress root. The upload of PHP files can pave the way for remote code execution. Once the site has been interfered with, the plugin deactivates itself and self-deletes to sidestep detection.<\/p>\n<p>The uploaded files include stolen data from victim machines, with more than 700 archives identified from mid-May to the end of July 2026. Among those files are internal development files and tools in what appears to be a case of the operator inadvertently infecting themselves. This includes a custom automation utility named \u00abfMain.frm\u00bb that&#8217;s used to manage compromised WordPress sites.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/corelight-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjuvAqH13TTYyJD3aI-pJcYl54BoxQWMHc2aFwW2HbYUa5IKCjvHlzpzkFwXLTuV8aytky8kqLBgkoOtC8VQM5CGR0N5BXBl8RSXl-PYx_vIPbiLywiqXIvTPmm18cdEm_C0heVB-3U8zfG7K27RCAurtJ7OvxEyfQ0sVV_RRx1N4ZMWkqKgEBmkcDgjD6I\/s728-e100\/code-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>\u00abThis automation tool allows the botnet operator to mass-manage compromised WordPress pages,\u00bb Check Point said. \u00abIt uses secure upload and delete PHP scripts on compromised websites to upload or delete additional files, activate or deactivate fake-captcha ClickFix, activate or deactivate caching, etc.\u00bb<\/p>\n<p>The compromised sites contain a malicious \u00abverify\u00bb plugin that overlays the original content with a fake CAPTCHA for non-Windows visitors. The plugin is activated after the threat actor uploads a file called \u00abactivator.php,\u00bb after which it deletes itself.<\/p>\n<p>As of July 24, 2026, the campaign has compromised more than 6,000 unique IP addresses. Most of them are located in the U.S. (1,852), Russia (630), and India (630).<\/p>\n<p>\u00abStopAndProtect shows how attackers can turn thousands of poorly maintained WordPress sites into a distributed criminal infrastructure for malware delivery, surveillance, data theft, and ransomware,\u00bb Check Point&#8217;s Eli Smadja said. <\/p>\n<p>\u00abWe urge organizations to be cautious of unexpected CAPTCHA prompts that instruct them to copy, paste, or run commands, keep their devices and security software updated, and immediately leave any website that asks them to perform unusual steps outside the browser.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Cybersecurity researchers have flagged a global cybercrime operation that abuses thousands of hacked WordPress websites as infrastructure to disseminate malware, commandeer infected hosts, store stolen documents, screenshots, and activity logs&hellip;<\/p>\n","protected":false},"author":1,"featured_media":2437,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[38,715,42,228,262,571,3074,1927],"class_list":["post-2436","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-data","tag-hacked","tag-malware","tag-sites","tag-spread","tag-steal","tag-stopandprotect","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2436","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2436"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2436\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2437"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2436"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2436"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2436"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}