StopAndProtect: The Ransomware Campaign Turning Nearly 2,000 WordPress Sites into Criminal Infrastructure

A Botnet Built on Compromised WordPress Sites

Check Point Research identified StopAndProtect, a global criminal operation active since at least mid-May 2026. The campaign leverages nearly 2,000 compromised WordPress sites to distribute malware, issue commands to infected systems, collect logs, and store documents, screenshots, and other stolen data.

The infrastructure does not rely on a single command-and-control server. The compromised sites perform three functions simultaneously: hosting infection components, receiving operator commands, and storing data collected from victims.

As of July 24, 2026, more than 6,000 unique IP addresses had been compromised. The United States accounted for the largest share, with 1,852 IPs, followed by Russia and India, each with 630 addresses.

The campaign was initially associated with a ransomware family called StopAndProtect. However, in most observed incidents, the attackers did not immediately encrypt devices. They first enumerated available files, identified those of interest, and potentially exfiltrated them.

A Fake CAPTCHA Triggers the Infection Chain

Initial access is obtained through a ClickFix-style social engineering campaign. Visitors reach a compromised WordPress site and see a fake CAPTCHA, often overlaid on the original page.

The procedure instructs users to copy, paste, or execute a command. This is not a simple anti-spam check: the instruction leads to PowerShell execution on the victim’s computer.

The technical chain consists of several stages:

1. an initial .NET downloader sends statistics to the C2 server and downloads the next component;
2. a second .NET downloader/loader performs anti-sandbox checks, generates additional logs, and prepares the environment;
3. the final stage loads the operational modules selected according to the operator’s objectives.

Anti-sandbox checks can help attackers distinguish real systems from automated analysis environments. Detailed logging, meanwhile, allows them to track infection progress and manage compromised machines.

The fake CAPTCHA is particularly deceptive because it exploits behavior that users have come to recognize. However, requests to execute commands outside the browser’s normal interface should be treated as a potential sign of compromise or fraud.

Six Modules for Spying, Spreading, and Encryption

StopAndProtect’s operational stage comprises six main components, although not all of them are necessarily installed on every system.

SilentEncryptor can encrypt every infected computer or restrict its activity to devices with specific hostnames. This allows the attackers to target selected systems rather than automatically encrypting everything indiscriminately.

NetworkShareScanner is a worm capable of spreading through SMB and USB drives. The module can therefore extend the infection beyond the initially compromised computer.

A similar function is performed by the VBS spreader, which copies the malware to hard drives and removable devices, analyzes the network, and attempts lateral movement through WMI.

LockScreen blocks user input and displays a ransom note. The message includes a QR code intended to facilitate payment.

Communication between the victim and the operator can take place through SimpleChatProxy, a custom chat application. This gives the criminal group an operational channel integrated into the attack ecosystem.

Finally, SilentDataCollector creates a list of the drives present on the system, encrypts it, and sends it to the C2 infrastructure. The operator can also upload a command file, which the stealer component uses to locate and collect specific files.

Keylogging, Screenshots, and WhatsApp Data Theft

The stealer’s latest versions significantly expand surveillance capabilities. The malware logs keystrokes, identifies valid email addresses, collects data from WhatsApp, and can map or disconnect network shares.

One of the most intrusive features is the automatic capture of screenshots every 30 seconds. This allows the attackers to reconstruct user activity even when documents or credentials are not directly stolen.

The WhatsApp module supports both the Web and desktop versions. The operator can specify a keyword, such as a contact’s name. When the victim is not actively using the computer, the malware searches for the keyword, opens the associated contact information, and captures a screenshot.

The resulting collection may include conversations, documents, credentials, screenshots of business applications, and information useful for further fraud. The ability to use SMB, USB, and WMI for lateral movement also increases the risk to networks with limited segmentation.

How the Attackers Control the Compromised Sites

Compromising WordPress sites serves more than simply displaying the fake CAPTCHA. The operators use a ZIP archive containing uploader-installer.php, a PHP script capable of installing a custom plugin.

The plugin creates a must-use plugin in the wp-content/mu-plugins directory. This mechanism causes the code to load automatically and makes persistence less visible than a standard plugin activated through the administrative interface.

Using valid credentials, the attackers can upload arbitrary files, including PHP scripts, to almost any location below the WordPress root directory. Uploading PHP code can lead to remote command execution on the server.

After completing their operations, the plugin deactivates and deletes itself to reduce the likelihood of detection. Uploaded files may nevertheless remain on the site and can include data exfiltrated from victims’ systems.

A second component, called verify, overlays the site’s content with the fake CAPTCHA. It is activated through activator.php, which then deletes itself.

Most of the sites observed were running outdated versions of WordPress or unpatched plugins. One analyzed site was running a WordPress version dating back to 2021 and was exposed to approximately 40 vulnerabilities.

Accidental data exposure also made it possible to observe the attackers’ administrative machine. Between mid-May and late July 2026, researchers identified more than 700 archives containing stolen data, as well as internal tools apparently taken from the operators themselves after an accidental infection.

Among them was fMain.frm, a utility used to administer numerous WordPress sites, upload or delete files, manage PHP scripts, activate the fake CAPTCHA, and control caching.

Urgent Checks for Organizations and Administrators

WordPress administrators should update the CMS, plugins, themes, and the server’s operating system. Particular attention should be paid to the wp-content/mu-plugins directory, the uploader-installer.php and activator.php files, and the presence of the verify plugin.

Access logs, PHP file uploads, plugin changes, and connections to unrecognized infrastructure should be reviewed. Recently deleted files and anomalous activity in WordPress directories may also provide evidence of compromise.

On endpoint systems, organizations should monitor PowerShell, .NET loaders, SMB and USB access, WMI usage, encryption processes, screen locking, and automated WhatsApp activity. Suspicious hosts should be isolated from the network immediately.

Potentially exposed WordPress credentials should be rotated, along with any tokens and keys accessible from the server. Organizations should also check whether the same accounts were reused on other services.

Users should immediately leave pages that ask them to copy and paste commands or execute unusual instructions to pass a CAPTCHA. StopAndProtect demonstrates how an apparently legitimate website can become, without obvious warning to visitors, the first link in a chain leading to data theft and ransomware.