Nearly 2,000 Hacked WordPress Sites Are Powering a Surprisingly Sophisticated Criminal Operation
A cybercrime campaign tracked as StopAndProtect has quietly assembled a botnet of close to 2,000 compromised WordPress sites to distribute malware, exfiltrate stolen data, and in some cases deploy ransomware. Researchers at Check Point flagged it in mid-May 2026 and have been picking it apart ever since.
The name comes from a ransomware family they found during initial analysis, but ransomware is actually the least common outcome here. More often, the attackers are quietly mapping victim file systems and siphoning off specific documents. The ransom angle is almost an afterthought.
The whole thing kicks off with a ClickFix attack. Victims land on a compromised website, get served a fake CAPTCHA prompt, and are nudged into running a PowerShell command manually. Classic stuff, but it keeps working because people keep running arbitrary commands when a webpage tells them to. From there, a chain of .NET downloaders and loaders fires off in sequence, eventually dropping a modular toolkit with a fairly alarming feature set.
The final payload bundle includes a file encryptor, a worm that spreads over SMB and USB, a VBS-based spreader that uses WMI for lateral movement, a screen locker with a QR code payment prompt, a live chat client so attackers can communicate directly with victims, and a credential and document stealer. That last one has grown more capable over time, adding a keylogger, WhatsApp scraping, network share manipulation, and screenshots every 30 seconds when the victim goes idle.
The WhatsApp exfiltration deserves a mention. The stealer waits for the user to step away, then automates the WhatsApp interface to search for a contact name specified by the operator, opens their profile, and screenshots it. Both the web and desktop versions are supported. Subtle it is not, but apparently it works.
What makes this campaign more interesting than the average commodity malware operation is the infrastructure model. Rather than running dedicated C2 servers, the group has co-opted nearly 2,000 neglected WordPress installations to handle everything: serving malware payloads, relaying instructions, and storing stolen data archives. One of the compromised sites was still running a 2021 WordPress build, which carries roughly 40 known vulnerabilities. The attackers are farming negligence.
The takeover process involves uploading a ZIP archive containing a PHP installer that creates a must-use WordPress plugin. That plugin, once active, lets anyone with valid credentials push arbitrary files, including PHP, to almost anywhere under the WordPress root. After doing its job, the plugin disables and deletes itself. Clean, if not exactly novel.
Check Point got deeper visibility into the operation than the attackers intended. Operational security was sloppy enough that infection logs, victim screenshots, and the operators' own management tools ended up exposed on compromised sites. Among more than 700 data archives recovered between May and late July, researchers found what appear to be the operators' own development files, suggesting someone on the team managed to infect themselves. Always a nice touch.
Those internal files included a custom automation tool called fMain.frm, which the group uses to mass-manage their hijacked WordPress estate. It can toggle the fake CAPTCHA overlays on and off, handle file uploads and deletions, and manage caching. Professional enough for a criminal operation running at scale, careless enough to leave it sitting on one of their own compromised sites.
By 24 July 2026, the campaign had hit over 6,000 unique IP addresses. The US accounted for the largest share at 1,852, with Russia and India both at 630.
The practical advice is straightforward: if a website asks you to open a terminal and paste a command, close the tab. Keep WordPress installations updated, retire unused plugins, and treat any unexpected CAPTCHA that requires action outside the browser as hostile. The technical bar for these attacks is not especially high. The success rate depends almost entirely on user compliance and admin laziness.