StopAndProtect is a cybercrime operation identified by Check Point Research that leverages nearly 2,000 hacked WordPress sites as a shared platform for malware distribution, data theft, surveillance, and ransomware. The attack begins with a fake CAPTCHA using the ClickFix technique to trick users into running PowerShell commands, which download multiple malware stages written in .NET. The malware components include ransomware, SMB/USB worms, screen lockers, VBS spreaders, chat utilities, and credential stealers. The compromised WordPress sites are used to host malware, deliver commands, receive logs, and store stolen files. Many sites run outdated WordPress versions or plugins with numerous known vulnerabilities. The attackers use automation tools to manage payloads across compromised sites. The campaign collected over 700 archives of stolen data, including screenshots and credentials, demonstrating a surveillance operation with ransomware capabilities. The infection chain and infrastructure were active from May to July 2026, with victims worldwide.

The operation enables attackers to use compromised WordPress sites as infrastructure for distributing malware, stealing sensitive data, surveilling victims, and deploying ransomware. Victims may suffer data theft, credential compromise, surveillance of their activities, and potential file encryption or screen locking. The campaign's use of nearly 2,000 hacked sites amplifies its reach and persistence. The stolen data includes passwords, wallet information, screenshots of victim desktops and applications, and activity logs, increasing the risk of further exploitation. The operation also demonstrates the risk of compromised websites being repurposed for large-scale criminal activities beyond the initial breach.

Website owners should ensure WordPress core, plugins, and themes are fully updated and remove unsupported components. Administrative accounts must be secured with strong passwords and multi-factor authentication. Regularly review installed plugins and check for unexpected PHP files or unfamiliar administrator accounts. Monitor web server logs, outbound connections, and recent file changes for signs of compromise. Visitors should never follow instructions from CAPTCHAs or websites that prompt running PowerShell commands or disabling security controls; such requests indicate malicious intent and the page should be closed immediately. These steps help prevent initial compromise and limit the use of sites in such criminal networks.