StopAndProtect is a criminal operation identified in mid-2026 that leverages thousands of compromised WordPress websites as infrastructure for malware distribution, command and control, and data exfiltration. The infection begins with a social engineering technique involving a fake CAPTCHA ClickFix prompt that leads victims to execute a PowerShell command. This triggers a multi-stage infection involving .NET downloaders and loaders, deploying various malware components including ransomware, SMB/USB worms, LockScreen utilities, VBS spreaders, chat tools, and credential stealers. The operation collects telemetry and logs from infected machines, which are stored on hacked WordPress sites. Due to OPSEC failures, researchers accessed exposed directories containing logs, screenshots, and source code, revealing the operation's scale and tools. The attackers exploit outdated WordPress installations and vulnerable plugins, with some sites running versions from 2021 and containing multiple vulnerabilities such as SQL injection, authentication bypass, and arbitrary file uploads. The campaign is widespread, targeting thousands of IP addresses worldwide.

The operation enables attackers to encrypt victim files (ransomware), steal sensitive documents and credentials, lock victim screens, and maintain persistent control via chat utilities. The abuse of thousands of compromised WordPress sites as infrastructure amplifies the attack's reach and resilience. Victims suffer data loss, potential credential compromise, and operational disruption. The exposure of attacker infrastructure and logs indicates a large-scale, coordinated campaign affecting diverse geographic regions. The exploitation of vulnerable WordPress sites also highlights risks to website owners who do not maintain timely updates and security patches.

No official patch or fix is available for the StopAndProtect operation itself, as it is a criminal campaign leveraging compromised WordPress sites. Website owners should ensure their WordPress installations and plugins are kept up to date and secure to prevent compromise. Users should be cautious of social engineering prompts such as fake CAPTCHA ClickFix messages and avoid executing unsolicited PowerShell commands. Incident responders should investigate infections for multiple malware components and consider the possibility of data theft and ransomware. Monitoring for signs of compromise on WordPress infrastructure and removing unauthorized scripts is critical. Since the operation relies on hacked WordPress sites, securing and patching these sites is the primary mitigation step. Patch status is not yet confirmed for any specific vulnerabilities exploited; check vendor advisories for updates on WordPress and plugin security.