Nearly 2,000 Hacked WordPress Sites Turned Into Criminal Infrastructure

In brief

• Check Point Research identified nearly 2,000 compromised WordPress sites used by the StopAndProtect malware operation.
• More than 6,000 unique IP addresses had been compromised as of July 24, including 1,852 in the United States.
• Researchers believe the attackers accidentally infected themselves, exposing internal files and tools used to manage compromised sites.

Nearly 2,000 hacked WordPress websites were used to distribute malware, steal data, monitor victims, and deploy ransomware, according to cybersecurity firm Check Point Research.

In the report published on Tuesday, researchers said the StopAndProtect ransomware family was first discovered in mid-May before tracing it to a broader operation. The hacked websites hosted malware, sent commands to infected computers, and stored stolen documents, screenshots, and activity logs.

“The operation doesn’t rely on a single piece of malware, but on a whole toolkit of criminal software working together,” Check Point researcher Jaromír Horejsi wrote. “Some components encrypt files, others silently steal documents or lock the screen, and another acts as a live chat between the attackers and their victims.”

According to Check Point, the malware targets Windows users and begins with a fake CAPTCHA on a compromised website. The ClickFix prompt instructs victims to run a PowerShell command that installs malware capable of stealing credentials, cryptocurrency wallet seed phrases, spreading through networks and USB drives, locking screens, and deploying ransomware.