StopAndProtect Operation Exploits Thousands of Hacked WordPress Sites for Data Theft

Research by: Jaromír Hořejší (@JaromirHorejsi)

StopAndProtect Operation: A New Threat Landscape

The StopAndProtect operation has emerged as a significant threat, exploiting thousands of compromised WordPress sites to facilitate data theft and ransomware attacks. This operation utilizes a sophisticated infrastructure that combines file encryption with data exfiltration, leveraging hacked websites as command and control (C&C) servers to manage infected machines and store stolen data. The findings from Check Point Research reveal a complex web of malware components that work in unison, highlighting the need for heightened vigilance in cybersecurity practices.

Operational Overview

First identified in May 2026, the StopAndProtect operation employs a ClickFix social-engineering technique to lure victims into executing a PowerShell command. This initiates a multi-stage infection process involving .NET-based downloaders and loaders, ultimately deploying various malicious components, including ransomware, a credential stealer, and a chat utility for communication between attackers and victims. Notably, while the operation is named after its ransomware component, it often focuses on silently exfiltrating files rather than encrypting them.

The operational security failures of the attackers have inadvertently exposed a wealth of information, including detailed logs from infected machines and the source code of their management tools. This has provided researchers with insights into the scale of the operation, which has affected thousands of IP addresses across multiple countries, predominantly in the US, Russia, and India.

Infection Chain and Technical Details

The infection chain begins when a victim visits a compromised WordPress site and encounters a fake CAPTCHA prompt. If the victim interacts with this prompt, they unwittingly execute a PowerShell script that leads to further stages of infection. The process is as follows:

• ClickFix → PowerShell script 1 → PowerShell script 2 → Stage 1 (loader) → Stage 2 (downloader & loader) → Stage 3 (components: encryptor, SMB/USB worm, lockscreen, credential stealer, VBS spreader, chat utility).

The initial PowerShell script logs execution details and downloads subsequent stages, which include a downloader that reports statistics back to the C&C server. The final stage encompasses various malicious payloads, including a ransomware component that can encrypt files based on specific criteria, and a stealer that collects sensitive data from the victim’s machine.

Data Exfiltration and Victim Impact

The operation has been particularly effective in exfiltrating sensitive data from victims. Researchers have identified over 700 encrypted ZIP archives containing stolen files, including documents, passwords, and screenshots. The naming conventions of these archives suggest a systematic approach to data collection, with files often labeled according to their content and the machine from which they were taken.

During the monitoring period, approximately 31,000 screenshots were collected from victims’ machines, revealing personal information and activities, including ransom messages and interactions with antivirus software. This level of detail underscores the invasive nature of the StopAndProtect operation and the potential for significant personal and organizational harm.

Conclusion and Recommendations

The StopAndProtect operation exemplifies the evolving tactics of cybercriminals, utilizing compromised infrastructure to execute complex attacks. Organizations must prioritize the security of their web applications, particularly those built on platforms like WordPress, by ensuring regular updates and patching of vulnerabilities. Additionally, implementing robust monitoring and incident response strategies can help mitigate the risks associated with such sophisticated threats.

For more detailed insights into the StopAndProtect operation, including technical analysis and statistics, refer to the full report by Check Point Research here.