Hackers Abuse Thousands of WordPress Sites to Spread StopAndProtect Malware via ClickFix

A large-scale malware operation called StopAndProtect is exploiting thousands of compromised WordPress websites to distribute ransomware, steal files, harvest credentials, and remotely monitor victims through deceptive ClickFix CAPTCHA prompts.

Researchers first identified the campaign in mid-May 2026. They discovered that the operation utilizes a broad range of criminal tools rather than relying on a single ransomware payload.

The attackers use hacked WordPress sites as platforms for hosting malware, command-and-control (C2) infrastructure, and repositories for stolen files, screenshots, and infection logs.

Hackers Abuse Thousands of WordPress Sites

The attack begins when victims visit a compromised website and encounter a fake CAPTCHA verification page. This page employs the increasingly common ClickFix social-engineering technique, instructing users to copy and execute a PowerShell command.

This command launches a hidden PowerShell process with an execution policy bypass, which downloads the next-stage payload from infrastructure controlled by the attackers.

The subsequent infection chain involves two PowerShell stages and multiple .NET loaders before delivering modular payloads. These payloads include the SilentEncryptor ransomware, a credential stealer, a lock-screen component, a VBS-based spreader, an SMB and USB worm, and a chat utility that enables direct communication between operators and victims.

Unlike conventional ransomware campaigns, StopAndProtect does not always encrypt files. In many instances, attackers silently inventory drives, exfiltrate selected documents, capture screenshots, and gather credentials before deciding whether to deploy ransomware.

The SilentDataCollector module enumerates files across fixed, removable, and network drives, then packages and encrypts chosen data for exfiltration.

Newer variants reportedly include keylogging, email address detection, WhatsApp contact collection, mapping of network shares, and screenshots taken at 30-second intervals while users are active.

Researchers also observed functionality capable of automating WhatsApp searches and capturing contact details, indicating that hands-on-keyboard activity has occurred in some cases.

The ransomware component, SilentEncryptor, downloads instructions specifying which systems to encrypt and displays a victim-specific ransom message.

Meanwhile, the NetworkShareScanner module attempts lateral movement by identifying SMB shares and connected USB devices. The LockScreen payload blocks user input and displays a ransom demand. At the same time, the custom SimpleChatProxy utility allows victims to communicate with the attackers.

Operational security failures revealed substantial evidence of the campaign’s scale. Open directories on compromised WordPress infrastructure contained malware samples, execution logs, victims’ screenshots, and over 700 stolen data archives.

Researchers from CheckPoint collected approximately 31,000 screenshots between mid-May and late July, including desktop activity, locked-screen messages, encrypted-file listings, browser sessions, and security software windows.

Internal logs identified more than 6,000 unique IP addresses linked to the operation as of July 24. The largest concentrations were in the United States, Russia, and India, with 1,852, 630, and 630 unique IPs, respectively.

A separate ClickFix log from a single server recorded nearly 600 unique visitor IPs, although researchers noted that the dataset was incomplete.

Investigators also uncovered source code and files apparently belonging to the threat actor. One archive contained a Visual Basic 6-based automation tool used to mass-manage compromised WordPress sites. Associated domain lists referenced nearly 2,000 sites, suggesting that the actor maintains a large web-based botnet.

The attackers ensure persistence through malicious WordPress plugins, including hidden must-use plugins placed in the wp-content/mu-plugins directory.

One observed plugin created a concealed REST API upload endpoint, allowing anyone with hardcoded credentials to upload files, including PHP payloads, to vulnerable sites. The installer then deactivated and deleted itself to minimize visibility.

Organizations should block the indicated threats, investigate suspicious PowerShell activity, audit WordPress installations and plugins, inspect mu-plugins directories, and educate users never to execute commands copied from CAPTCHA or browser prompts.

IOC Table

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC