A newly identified cybercrime operation dubbed StopAndProtect has been quietly running its entire criminal infrastructure through close to 2,000 hacked WordPress websites, according to new research from Check Point.
Rather than relying on dedicated command-and-control servers, which are relatively easy for defenders to identify and take down, the group behind StopAndProtect compromised thousands of legitimate WordPress sites and repurposed them to host malware, issue commands to infected machines, and store data stolen from victims. Because the traffic blends in with ordinary website activity, the approach gave the operation a resilient, low-visibility footprint that could withstand takedown attempts on any single node.
Researchers first spotted the ransomware component behind the campaign in mid-May 2026. Deeper analysis of the surrounding infrastructure revealed a far larger and more complex operation combining ransomware, data theft, credential stealing, and surveillance capabilities within a single toolkit.
A fake CAPTCHA is the way in
The infection begins with a technique known as ClickFix, now one of the fastest-growing social engineering methods in circulation. Visitors to a compromised website are shown a fake “human verification” prompt styled to resemble a Cloudflare CAPTCHA. Instead of simply ticking a box, victims are instructed to open the Windows Run dialog, paste a command, and press Enter.
That single action triggers a multi-stage infection chain, a PowerShell script followed by several .NET downloader and loader stages, that ultimately delivers one or more of six modular components: a file encryptor, an SMB/USB worm for lateral spread, a screen-locking module, a credential stealer, a VBS spreader, and a custom chat tool that lets the attacker communicate directly with the victim.
Although the ransomware component gave the operation its name, Check Point noted that file encryption is not deployed against every victim. In many cases, the attackers instead work quietly in the background, exfiltrating lists of files and then specific documents without ever alerting the victim.
Screenshots, stolen files and automated WhatsApp searches
The data-theft component, which Check Point calls SilentDataCollector, proved to be one of the more advanced pieces of the toolkit. Beyond harvesting files, passwords, and cryptocurrency wallets, newer versions include a keylogger capable of detecting valid email addresses, the ability to map and unmap network shares, and a feature that captures screenshots of victim activity at 30-second intervals.
In one particularly unusual detail, researchers found that operators could issue a WhatsApp search keyword to the stealer, which would then wait until the victim became inactive before automating both the desktop and web versions of WhatsApp to search for the named contact, open their contact information, and capture a screenshot, including the associated phone number.
Between mid-May and the end of July 2026, Check Point says it collected more than 31,000 screenshots and over 700 stolen data archives from the exposed infrastructure. Internal logs pointed to more than 6,000 unique victim IP addresses, with the largest concentrations in the United States, Russia, and India.
The operators became their own biggest liability
The operation might have gone unnoticed for far longer if its operators hadn’t made a critical error. Check Point discovered a PHP script exposing directory listings on a compromised server, which in turn led to further open directories containing infection logs, victim screenshots, and internal management tools.
Among the exposed files, researchers found what they believe is evidence that one of the operators infected their own computer with the group’s own malware, inadvertently uploading personal desktop files to the same collection server used to store data stolen from victims. The archive was removed within a few days, but not before Check Point had captured it.
That exposure included the source code for a custom automation tool, built in Visual Basic 6, a development platform released almost 30 years ago, whose mainstream support ended around two decades ago, that the operators use to mass-manage compromised WordPress sites: uploading and deleting files, and toggling the fake CAPTCHA on and off across their network. Text files recovered from the same archive listed close to 2,000 compromised WordPress domains, giving researchers a rare, direct measure of the operation’s true scale.
Eli Smadja of Check Point Research said the findings illustrate how easily poorly maintained websites can be pulled into large-scale criminal operations. “StopAndProtect shows how attackers can turn thousands of poorly maintained WordPress sites into a distributed criminal infrastructure for malware delivery, surveillance, data theft, and ransomware,” Smadja said. “Based on our research findings, we urge organisations to be cautious of unexpected CAPTCHA prompts that instruct them to copy, paste, or run commands, keep their devices and security software updated, and immediately leave any website that asks them to perform unusual steps outside the browser.”
Neglected plugins, five-year-old software
The research underscores a persistent problem in the WordPress ecosystem, which according to Statista accounts for more than 43% of the global website-builder market as of 2026. Out of curiosity, Check Point scanned one of the compromised sites and found it was still running a version of WordPress dating back to 2021, almost five years out of date, with nearly 40 identifiable vulnerabilities, including expired certificates, SQL injection flaws, open redirects, authentication bypasses, and arbitrary file upload issues.
On several of the compromised sites, researchers also found a malicious “must-use” (MU) WordPress plugin installed via a custom backdoor installer. Unlike standard plugins, MU plugins load automatically on every site request and do not appear in the normal plugins interface, making them a favoured mechanism for attacker persistence. The plugin added a hidden REST API endpoint authenticated with hardcoded credentials, allowing anyone with the password to upload files, including PHP files capable of remote code execution, to almost any path on the site, before deactivating and deleting itself to avoid detection.
Recommendations
Check Point recommends that organisations:
- Keep WordPress core installations and plugins fully patched and up to date
- Educate users to recognise ClickFix-style social engineering, and treat any prompt asking them to paste and run a command as a red flag
- Monitor for suspicious PowerShell activity on endpoints
- Adopt a prevention-first security strategy that stops attacks before malware establishes persistence or exfiltrates data
For consumers, the advice is simpler still: legitimate CAPTCHA checks never require copying, pasting, or running commands outside the browser. Any site that asks for this should be treated with suspicion, and closed immediately.
