A recent investigation by Check Point has unveiled a significant cybercrime operation known as StopAndProtect, which has been quietly operating through approximately 2,000 compromised WordPress websites. This revelation highlights the serious vulnerabilities within popular website-building platforms and raises alarms about the growing sophistication of cybercriminal tactics.
The StopAndProtect operation deviates from traditional cybercrime methodologies by eschewing dedicated command-and-control servers, which are often easier for cybersecurity professionals to detect and dismantle. Instead, the perpetrators have hijacked a multitude of legitimate WordPress sites, utilizing them as a foundation for hosting malware, issuing commands to infected devices, and storing data obtained unlawfully from victims. This approach has allowed the operation to maintain a low profile and endure takedown attempts targeting individual nodes, effectively blending malicious activities with normal web traffic.
Researchers first identified the ransomware component associated with StopAndProtect in mid-May 2026. Following a thorough analysis of the infrastructure, it became evident that this operation is more extensive and intricate than initially perceived. It not only encompasses ransomware but also incorporates data theft, credential pilfering, and surveillance modules into a cohesive toolkit, elevating the complexity of the cyber threat.
The infection process initiates through a method known as ClickFix, which has surfaced as a rising star among social engineering tactics. Users visiting compromised websites encounter a deceptive “human verification” prompt, designed to mimic a Cloudflare CAPTCHA. Unlike a conventional CAPTCHA, this prompt instructs victims to open their Windows Run dialog, paste a specific command, and execute it. This seemingly innocuous action sets off a multi-stage infection process, deploying a series of PowerShell scripts and .NET components that ultimately deliver various malicious modules. These modules range from file encryptors to screen-locking mechanisms and credential stealers, and they even include a custom chat feature that facilitates direct communication between the attacker and the victim.
While the ransomware aspect lent the operation its name, Check Point’s findings indicate that file encryption is not uniformly applied to all victims. In many instances, attackers enable silent data exfiltration, acquiring lists of files and specific documents without raising any alarms for the victim.
A noteworthy component of the operation, referred to as SilentDataCollector by Check Point, stands out due to its advanced capabilities. Beyond file collection, this tool harvests plain-text passwords and cryptocurrency wallets, while newer iterations have incorporated a keylogger capable of identifying valid email addresses. Additionally, the module possesses functionality to map network shares and capture screenshots of victim activity every half-minute.
In an unusual twist, researchers identified a feature allowing the operators to issue search queries to WhatsApp through the data thief. This mechanism activates when the victim becomes inactive, automating both the desktop and web versions of WhatsApp to search for specific contacts and capture screenshots, which include relevant phone numbers.
Between mid-May and late July 2026, Check Point documented over 31,000 screenshots and approximately 700 stolen data archives from the compromised infrastructure. Their internal logs revealed the presence of more than 6,000 unique victim IP addresses, with a significant concentration of incidents occurring in the United States, Russia, and India.
Unfortunately for the perpetrators, their operation could have remained concealed for a much longer duration if not for a critical error. Investigators discovered a PHP script that inadvertently exposed directory listings on a compromised server. This oversight led to the uncovering of additional directories containing infection logs, victim screenshots, and internal management tools. Among the sensitive files exposed in this breach was evidence suggesting that one of the operators had inadvertently infected their own machine with the group’s malware, resulting in the upload of personal files to the same collection server used for stolen data.
Among the exposed files was the source code for a custom automation tool designed in Visual Basic 6, a platform whose mainstream support had ended nearly two decades prior. This tool is utilized by the operators to manage their compromised WordPress sites, allowing them to upload and delete files and toggle the deceptive CAPTCHA on or off. The researchers recovered text files enumerating nearly 2,000 compromised WordPress domains, providing invaluable insight into the scale of the operation.
Eli Smadja from Check Point Research emphasized the findings’ implications, underscoring the ease with which neglected websites can become integral to extensive criminal activities. He urged organizations to remain vigilant regarding unexpected CAPTCHA prompts that require users to copy, paste, or execute commands. Smadja stressed the importance of keeping devices and security software updated and advised users to exit any website that requests suspicious actions outside standard web interactions.
The investigation into this operation also highlights a persistent issue within the WordPress ecosystem. As reported by Statista, WordPress commands more than 43% of the global website-building market as of 2026. Check Point’s analysis revealed that one compromised site was still operational on a WordPress version from 2021, presenting nearly 40 identifiable vulnerabilities ranging from SQL injection flaws to authentication bypasses.
The researchers also uncovered a malicious “must-use” WordPress plugin installed via a backdoor installer. Unlike standard plugins, which can be seen in the plugin interface, MU plugins automatically load with every site request, making them a preferred method for maintaining persistent access.
In response to these findings, Check Point recommends that organizations adhere to several guidelines to bolster their cybersecurity posture. These include maintaining up-to-date WordPress core installations and plugins, educating users about ClickFix-style social engineering, monitoring for unusual PowerShell activity, and embracing a prevention-first security strategy. For individual internet users, recognizing that legitimate CAPTCHA tests will never ask for commands to be executed outside of the browser is crucial; any site requesting such actions should be met with immediate skepticism.
As cyber threats evolve, both organizations and individuals must remain vigilant to protect themselves against operations like StopAndProtect, which exploit vulnerabilities in widely used web platforms.