Cybersecurity researchers have identified a significant cybercrime operation known as StopAndProtect, which exploits nearly 2,000 hacked WordPress websites to distribute malware and facilitate data theft. This operation utilizes a variety of malicious tools, including ransomware, credential stealers, and other components that work in tandem to compromise systems and exfiltrate sensitive information.
According to reporting by The Hacker News, the campaign was first detected in mid-May 2026, beginning with a social engineering attack that deploys a PowerShell command to install additional malware. The compromised sites serve multiple roles, including hosting malware, acting as command-and-control servers, and storing logs from infected systems.
Check Point Research noted that many of the hacked WordPress sites were running outdated versions of the platform, making them vulnerable to exploitation. The operation has been linked to a range of malicious activities, including the covert theft of files and the deployment of ransomware in some instances. The attackers have also been observed using a custom plugin that allows them to upload arbitrary files, potentially leading to remote code execution.
As of late July 2026, the campaign has affected over 6,000 unique IP addresses, primarily in the United States, Russia, and India. Researchers emphasize the importance of maintaining updated security measures and being cautious of unexpected prompts that could lead to malware infections.
Follow Cyber Warriors Middle East for further ransomware, cybercrime and DarkWatch developments.
