Cybercriminal operators have compromised close to 2,000 WordPress websites and converted them into a distributed network for delivering malware, controlling infected machines, and storing stolen data, according to a report published by Check Point Research in August 2026. The campaign, tracked under the name StopAndProtect after a ransomware variant discovered in mid-May 2026, deploys a complete toolkit of malicious software rather than relying on a single program. The operation has infected more than 6,000 unique IP addresses as of July 24, 2026, with the largest concentrations in the United States (1,852), Russia (630), and India (630).

The attack starts with a ClickFix social engineering tactic that tricks visitors into running a PowerShell command, which then downloads .NET loaders and launches six main components: file encryption software, an SMB and USB worm for network spreading, a VBS spreader for removable media, a screen-locking tool displaying ransom demands with QR codes, a custom chat application linking victims to operators, and a data theft program. The report notes that ransomware doesn't always deploy—in most instances, the attackers quietly steal file lists and then extract specific documents from compromised systems. The hacked WordPress sites perform three critical roles: hosting malware stages, operating as command-and-control servers, and archiving logs taken from victim computers. More than 700 archives containing stolen information were identified between mid-May and the end of July 2026, including internal development files suggesting the operator accidentally infected their own machine.

"The operation doesn't rely on a single piece of malware, but on a whole toolkit of criminal software working together," Check Point researcher Jaromír Hořejší stated in the report. The compromised websites run obsolete WordPress versions and outdated plugins—one example ran a 2021 WordPress release vulnerable to roughly 40 different security flaws. Attackers install a custom WordPress plugin via a PHP file that creates a must-use plugin in the "wp-content/mu-plugins" directory, allowing anyone with valid credentials to upload arbitrary files to nearly any location under the WordPress root, which can enable remote code execution. The plugin then deactivates and removes itself to avoid detection. According to the report, operational security mistakes by the threat actors exposed detailed infection logs, screenshots from victim devices, and a custom automation utility called "fMain.frm" used to mass-manage compromised WordPress pages.

The attackers exploit poorly maintained websites as infrastructure by uploading a malicious "verify" plugin that overlays original content with fake CAPTCHA prompts exclusively for Windows visitors—macOS and Linux users see normal pages. The plugin activates when the threat actor uploads a file named "activator.php," then self-deletes. Recent versions of the data theft component include a keylogger that detects valid email addresses, WhatsApp exfiltration for both web and desktop versions using automation to search contacts and capture screenshots, network share mapping, and screenshots of user activity captured every 30 seconds. The report warns that organizations should be cautious of unexpected CAPTCHA prompts instructing them to copy, paste, or run commands, keep devices and security software updated, and immediately leave websites requesting unusual steps outside the browser. The campaign demonstrates how thousands of neglected WordPress installations can be weaponized into a coordinated criminal infrastructure for malware distribution, surveillance, data theft, and ransomware deployment. Defenders face a persistent challenge when legitimate web infrastructure becomes indistinguishable from attack infrastructure, and when routine security hygiene remains the only practical barrier against mass exploitation.