Cybersecurity researchers have uncovered a sprawling StopAndProtect cybercrime operation that has turned nearly 2,000 compromised WordPress sites into a resilient global command-and-control and data-theft infrastructure.[1][4][10][14] Operational logs exposed through the gang’s own mistakes list more than 6,000 unique victim IP addresses across multiple regions, with infections heavily concentrated in the United States, Russia and India.[4] The campaign blends hands-on-keyboard access with automated malware delivery, giving operators a flexible platform to stage intrusions, move laterally and exfiltrate sensitive data at scale.[1][4][14]
The hacked WordPress sites serve multiple roles inside the operation: they host malicious payloads, act as relay points for commands to infected hosts and provide storage for stolen documents, screenshots and activity logs harvested from victims.[1][4][10] Researchers observed that the criminals maintain a rotating pool of nearly 2,000 domains, which makes takedowns harder and allows them to quickly swap infrastructure when individual sites are cleaned or sinkholed.[1][4][10] This use of compromised legitimate websites mirrors tactics seen in other campaigns that rely on large fleets of hacked WordPress installations for malware distribution and traffic redirection.[5][7][8]
StopAndProtect’s infection chain relies heavily on social engineering rather than browser or plugin exploits, using deceptive “ClickFix” and fake CAPTCHA lures injected into compromised WordPress pages to trick visitors into running a malicious PowerShell command.[1][4] Victims are instructed to copy and paste the command into a terminal, which launches a multi-stage sequence involving dual PowerShell scripts and .NET-based downloaders and loaders.[1][4] These stages ultimately deliver a modular toolkit that includes ransomware, an SMB and USB worm, a lockscreen component, credential-stealing malware, VBS-based spreaders and a chat utility that lets operators interact with compromised machines.[1][4][10] Not every intrusion ends with encryption; in many cases the toolkit is used primarily for stealthy data theft and long-term access.[1][4]
The data-theft component of StopAndProtect is particularly damaging, quietly siphoning corporate documents, system screenshots, stored credentials and traces of user activity from infected endpoints.[1][4] Researchers report that the operators also employ custom stealers capable of targeting popular messaging platforms, enabling them to capture communications and authentication artifacts that can be reused in further attacks or extortion attempts.[1][4][14] Combined with the ransomware and worm modules, this makes the operation capable of shifting quickly between smash-and-grab extortion, covert espionage and opportunistic lateral movement inside victim networks.[1][4]
The campaign underscores how attractive WordPress remains as criminal infrastructure, given its massive install base and patching gaps across themes and plugins.[9][12] In a separate effort earlier this year, international law enforcement under Operation Endgame disrupted infrastructure linked to the SocGholish FakeUpdates malware and reported cleaning infections from nearly 15,000 compromised WordPress sites, highlighting the scale at which attackers have been abusing the platform.[5][7] Security telemetry further indicates that most compromised WordPress installations harbor both active malware and persistent backdoors, giving threat actors durable footholds for campaigns like StopAndProtect.[9][12]
So far, researchers have not publicly tied StopAndProtect to a specific WordPress vulnerability or CVE, noting that attackers appear to be abusing already-compromised sites and socially engineering visitors instead of relying on fresh exploits.[1][4] That means defenders cannot depend on a single patch to neutralize the threat; securing WordPress deployments requires hardening administrative access, keeping core and plugins updated, removing unused extensions and monitoring for unauthorized code changes. On the endpoint side, organizations should block or closely monitor PowerShell usage, log script execution, deploy endpoint detection capable of spotting .NET loader behavior and train users to treat any instruction to paste commands from a browser into a terminal as a high-risk red flag. Together, tightening web application hygiene and improving endpoint visibility will be critical to limiting the operational space available to StopAndProtect and similar WordPress-powered malware operations.
References
- Thousands of Hacked WordPress Sites, One Operation
- WordPress Sites StopAndProtect Malware
- Operation Endgame Disrupts SocGholish Servers, Cleans …
- SocGholish Compromised WordPress Sites Special Report
- What happens if you visit a WordPress site hacked through …
- 43 WordPress Security Data Points That Should Change How You …
- Nicolas Krassas’ Post
- 40+ WordPress Hacking Statistics & Security Data (2026)
- Thousands of Hacked WordPress Sites, One Operation
