Stop AndProtect Uses Nearly 2,000 Hacked Word Press Sites to Spread Malware and Steal Data
Summary: Check Point Research is tracking a campaign it calls StopAndProtect, which uses close to 2,000 hacked WordPress sites to serve fake ClickFix CAPTCHA prompts that run a PowerShell command and deploy ransomware, an SMB/USB worm, a credential stealer, a keylogger and a chat utility. As of July 24, 2026, the operation had compromised more than 6,000 unique IP addresses, most in the U.S. (1,852), Russia (630) and India (630), and Check Point identified more than 700 uploaded archives of stolen data between mid-May and the end of July 2026.
What's compelling: The attackers' own automation tool, fMain.frm, mass-manages the compromised sites, and one site running a 2021 WordPress version was exposed to roughly 40 vulnerabilities - the infrastructure is built from sites nobody patched. Check Point's Jaromír Hořejší noted the operation does not always end in ransomware; in most cases the actors quietly steal file lists and specific files first.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026