Ethical Hacking News
A recent discovery by cybersecurity researchers has shed light on a sophisticated operation, dubbed "StopAndProtect," which uses thousands of hacked WordPress sites to spread malware, commandeer infected hosts, store stolen data, and extort ransom from unsuspecting victims. The operation, which has compromised more than 6,000 unique IP addresses, serves as a stark reminder of the threat landscape in the digital age. With its complex toolkit of criminal software working in tandem, StopAndProtect highlights the need for constant vigilance and proactive measures to protect against these evolving threats.
A sophisticated cyber operation, dubbed "StopAndProtect", has been discovered that leverages thousands of hacked WordPress sites to spread malware and extort ransom from unsuspecting victims. The operation uses a complex toolkit of criminal software, including ransomware, SMB/USB worm, and credential stealer, to carry out its nefarious activities. The threat actors rely on a cluster of hacked WordPress sites, numbering close to 2,000, as command-and-control (C2) servers to send instructions to infected hosts. The sites also store logs exfiltrated from victims, providing the attackers with valuable intelligence to track their activities. The exploitation of these compromised sites is facilitated by a series of vulnerabilities, many of which are linked to outdated versions of WordPress. The attackers use tampered websites to serve fake CAPTCHA prompts to visitors, infecting themselves in the process, and use a PowerShell command to spread their malware. The malware toolkit includes SilentEncryptor, NetworkShareScanner, VBS spreader, LockScreen, SimpleChatProxy, and SilentDataCollector, each serving a distinct purpose. The threat actors have implemented additional features in newer iterations of the stealer, including a keylogger and screenshot capture. The campaign has compromised over 6,000 unique IP addresses, with most of them located in the U.S., Russia, and India. Cybersecurity experts urge organizations to be cautious of unexpected CAPTCHA prompts and to prioritize security and take proactive measures to protect themselves against cyber threats.
In the ever-evolving landscape of cyber threats, a recent discovery has shed light on a sophisticated operation that leverages thousands of hacked WordPress sites to spread malware, commandeer infected hosts, store stolen data, and extort ransom from unsuspecting victims. The operation, dubbed "StopAndProtect," has been tracked by cybersecurity researchers, who have uncovered a complex toolkit of criminal software working in tandem to carry out these nefarious activities.
At the heart of this operation lies a ClickFix-style social engineering attack, which sets off a chain reaction of events that ultimately leads to the deployment of additional .NET downloaders and loaders. These components, in turn, give way to a suite of malicious software, including ransomware, SMB/USB worm, LockScreen, VBS spreader, chat utility, and credential stealer. Notably, the threat actors have been observed in most cases to covertly steal lists of files and then specific files from the systems, underscoring the adaptability and stealth of this operation.
One of the most striking aspects of StopAndProtect is its reliance on a cluster of hacked WordPress sites, which serve multiple functions. These sites, which number close to 2,000, have been compromised by the threat actors and are used as command-and-control (C2) servers to send instructions to infected hosts. The sites also store logs exfiltrated from victims, providing the attackers with valuable intelligence to track their activities.
The exploitation of these compromised sites is facilitated by a series of vulnerabilities, many of which are linked to outdated versions of WordPress. One such site, which runs a WordPress version from 2021, is found to be susceptible to roughly 40 different vulnerabilities, making it an attractive target for the threat actors.
To further spread their malware, the attackers have been using tampered websites to serve fake ClickFix-style CAPTCHA prompts to visitors, effectively infecting themselves in the process. This is achieved through a PowerShell command that acts as a conduit for a multi-step process, involving a stage 1 .NET downloader, a stage 2 .NET downloader and loader, and a stage 3 that includes six components, each serving a distinct purpose.
The six components of the malware toolkit include SilentEncryptor, which encrypts either all currently infected computers or only computers with given host names; NetworkShareScanner, which functions like an SMB/USB worm to spread to other devices; VBS spreader, which propagates the malware to hard disks and removable media, scans the network, and laterally moves via WMI; LockScreen, which blocks user input and displays a ransom message with a payment QR code; SimpleChatProxy, which is a custom chat application for communicating between the victim and operator; and SilentDataCollector, which generates a list of all drives, encrypts it, and exfiltrates this list to the C2 server.
In newer iterations of the stealer, additional features have been implemented, including a keylogger with valid email address detection, exfiltration from WhatsApp, mapping and unmapping network shares, and capturing screenshots of user activity every 30 seconds. Furthermore, the threat actors have been using a ZIP archive containing a PHP file ("uploader-installer.php") to install a custom WordPress plugin, which is used to create a must-use (MU) plugin file that's responsible for creating a must-use (MU) plugin file in the "wp-content/mu-plugins" directory.
This plugin lets anyone in possession of valid credentials upload arbitrary files, including PHP files, to the WordPress site to almost any path under the WordPress root. The upload of PHP files can pave the way for remote code execution. Once the site has been interfered with, the plugin deactivates itself and self-deletes to sidestep detection.
The uploaded files include stolen data from victim machines, with more than 700 archives identified from mid-May to the end of July 2026. Among those files are internal development files and tools in what appears to be a case of the operator inadvertently infecting themselves. This includes a custom automation utility named "fMain.frm" that's used to manage compromised WordPress sites.
The campaign, which has compromised more than 6,000 unique IP addresses as of July 24, 2026, with most of them located in the U.S. (1,852), Russia (630), and India (630), serves as a stark reminder of the threat landscape in the digital age. As Check Point Research's Eli Smadja noted, "StopAndProtect shows how attackers can turn thousands of poorly maintained WordPress sites into a distributed criminal infrastructure for malware delivery, surveillance, data theft, and ransomware."
Given the sophistication and scale of this operation, cybersecurity experts urge organizations to be cautious of unexpected CAPTCHA prompts that instruct them to copy, paste, or run commands. They also recommend keeping devices and security software updated, and immediately leaving any website that asks them to perform unusual steps outside the browser.
In conclusion, the StopAndProtect operation is a stark reminder of the ever-evolving nature of cyber threats and the need for constant vigilance and proactive measures to protect against these threats. As cybersecurity continues to evolve, it is imperative that organizations prioritize security and take proactive steps to protect themselves against the likes of StopAndProtect.
Related Information:
https://www.ethicalhackingnews.com/articles/StopAndProtect-A-Threat-Actors-Toolbox-for-Malware-Ransomware-and-Data-Theft-Using-Thousands-of-Hacked-WordPress-Sites-ehn.shtml
https://thehackernews.com/2026/08/stopandprotect-uses-nearly-2000-hacked.html
Published: Wed Aug 19 06:43:24 2026 by llama3.2 3B Q4_K_M
