When researchers at Check Point first stumbled on a ransomware family called StopAndProtect in mid-May 2026, they thought they were looking at another entry in an already crowded field. They were wrong. What they uncovered was something far more ambitious: a full-stack criminal operation that turned nearly 2,000 compromised WordPress websites into a distributed crime machine — and then made one fatal mistake that brought the whole thing into the light.
What Is StopAndProtect?
StopAndProtect is a cybercrime operation that doesn't just deploy malware — it runs an entire criminal ecosystem. The operation abuses thousands of hacked WordPress websites as its backbone, using them to spread malware, control infected machines, and store stolen documents, screenshots, and activity logs.
Over the course of their investigation, Check Point researchers collected more than 700 encrypted archives of stolen data between mid-May and the end of July 2026. Internal logs reveal thousands of IP addresses affected across the globe, with the heaviest concentration in the United States, Russia, and India.
This is not a small, isolated campaign. It's industrialized cybercrime built on the back of neglected websites.
The Anatomy of the Attack: ClickFix and the Fake CAPTCHA
The infection chain starts with something deceptively simple: a fake CAPTCHA. Victims visiting a compromised website see what looks like a standard verification prompt — the kind of "I'm not a robot" checkbox that internet users encounter dozens of times a day.
But this is ClickFix, a social engineering technique that's rapidly gaining traction across the threat landscape. Instead of verifying your humanity, clicking the prompt triggers a PowerShell command that begins a multi-stage infection chain:
- PowerShell Stage 1 — Reports back to the command-and-control server and downloads the next stage
- PowerShell Stage 2 — Decodes and loads a .NET assembly into memory
- .NET Stage 1 — A downloader that fetches additional components
- .NET Stage 2 — A persistent loader with sandbox detection and extensive logging
- Stage 3 — The final payload: a toolkit of criminal software
Every stage generates telemetry and uploads logs, giving the malware operators a real-time dashboard of infection progress across their victim fleet.
A Toolkit Built for Every Crime
What makes StopAndProtect particularly dangerous is its versatility. The Stage 3 payload isn't a single piece of malware — it's a Swiss Army knife of criminal tools:
- Ransomware — Encrypts files and demands payment
- Credential Stealer — Harvests passwords, browser data, and session cookies
- SMB/USB Worm — Spreads laterally across networks and via removable drives
- LockScreen — Displays a full-screen ransom message, locking victims out of their machines
- VBS Spreader — Propagates through Visual Basic scripts
- Chat Utility — A live communication channel between attackers and victims, used for extortion negotiation
Here's the chilling part: not every victim gets the ransomware treatment. In many cases, the attackers silently exfiltrate lists of files and then cherry-pick specific documents to steal. The ransomware is just one monetization path among several.
The Infrastructure: Your WordPress Site, Their Server
The entire operation runs on compromised WordPress websites. These aren't purpose-built servers rented under fake identities — they're real websites belonging to real businesses and individuals, many of whom have no idea they're hosting criminal infrastructure.
Check Point scanned one compromised site and found it was running a WordPress version from 2021 — nearly five years old. The scan identified almost 40 different vulnerabilities, including expired certificates, SQL injection flaws, open redirects, authentication bypasses, and arbitrary file upload vulnerabilities.
The attackers use these sites for three critical functions:
- Malware hosting — Serving download stages to new victims
- Command and control — Passing instructions to infected machines
- Data storage — Housing stolen documents, screenshots, and infection logs
The compromised sites also host custom PHP scripts — password-protected file managers, uploaders, and deletion utilities — that let the operators manage their stolen data at scale.
The Mistake That Brought It All Down
Every criminal operation has a weakness, and StopAndProtect's was spectacularly human. The developer made an operational security mistake so fundamental it almost seems careless: they accidentally infected their own machine and uploaded their desktop files to the collection server.
Among those files? The source code of an automation tool designed to manage injected payloads across compromised WordPress sites at scale. And, critically, a text file listing close to 2,000 compromised WordPress domains.
That single mistake gave Check Point researchers a complete map of the operation's infrastructure — turning months of careful investigation into an open book.
Why WordPress? Why Now?
WordPress powers approximately 43% of all websites worldwide. That dominance makes it the single largest attack surface on the internet. And the uncomfortable truth is that a significant portion of WordPress installations are badly maintained.
Outdated core software, unpatched plugins, expired SSL certificates, and abandoned themes create a sprawling landscape of vulnerable sites that organized crime groups can harvest at scale. StopAndProtect didn't need to find a zero-day exploit. They didn't need a sophisticated supply chain attack. They just needed sites that hadn't been updated in years.
The ClickFix entry point is equally low-tech. No sophisticated phishing kit, no zero-day browser exploit — just a fake CAPTCHA prompt that asks users to copy and paste a command. And people do it, because the prompt looks exactly like every other CAPTCHA they've seen.
What This Means for Your Business
If your organization runs WordPress — and statistically, there's a 43% chance it does — this story is a direct operational risk. A compromised website doesn't just mean defacement or downtime. It means your domain could be weaponized as part of a global crime operation, your visitors could be infected, and your brand could be associated with ransomware distribution.
Here's what every business should do right now:
- Audit your WordPress installations — Check core version, plugin versions, and theme versions. If anything is more than one major version behind, update immediately.
- Remove unused plugins and themes — Every inactive plugin is a potential backdoor. If you're not using it, delete it.
- Enable automatic updates — WordPress core supports automatic minor version updates. Enable them.
- Implement a Web Application Firewall — A WAF can block the initial exploit attempts that lead to compromise.
- Monitor for unexpected files — If your WordPress site suddenly contains PHP files you didn't create, you may already be part of someone else's infrastructure.
The StopAndProtect operation is a reminder that cybersecurity isn't just about protecting your own data — it's about ensuring your digital assets aren't turned into weapons against others. In a world where 2,000 neglected websites can power a global crime ring, every site owner has a responsibility to keep their house in order.
The attackers are counting on you to leave your WordPress site unpatched. Don't give them what they want.