StopAndProtect: How Hackers Turned Nearly 2,000 WordPress Sites Into a Global Crime Network — Without Their Owners Ever Knowing
Some WordPress hacks steal your traffic. This one turned nearly 2,000 hacked WordPress sites into the actual infrastructure of an organized cybercrime operation — quietly using compromised small-business websites to spread ransomware, steal data, and run remote surveillance on unsuspecting visitors, while the site owners themselves had no idea anything was wrong.
What StopAndProtect actually is
Named by Check Point Research after a ransomware component they found during the investigation, StopAndProtect isn’t a single piece of malware — it’s an entire criminal operation built on top of hijacked WordPress infrastructure. By the time researchers Jaromír Hořejší and Eli Smadja mapped its full scale in July 2026, the network spanned nearly 2,000 compromised WordPress sites and more than 6,000 unique IP addresses, with victims concentrated in the U.S., Russia, and India.
How it actually worked
The entry point was a technique called “ClickFix” — a fake CAPTCHA prompt injected into hacked WordPress sites that looks like a routine “prove you’re human” check. Instead of verifying anything, it walks the visitor through copying and running a PowerShell command on their own computer, tricking them into infecting themselves under the guise of completing a normal security step. It’s a deceptively effective technique precisely because it exploits something people have been trained to do without thinking twice.
Once triggered, the infection unfolded in stages: a multi-stage .NET downloader pulled in the real payload, which could include SilentEncryptor (a ransomware variant), a worm called NetworkShareScanner built to spread across shared drives and USB devices, and — most unsettling — SilentDataCollector, a surveillance tool capable of logging keystrokes, automating WhatsApp activity, and capturing a screenshot of the victim’s screen every 30 seconds. Researchers identified more than 700 stolen data archives collected through the operation between May and July 2026 alone.
The twist that exposed it
Here’s the detail that makes this story worth remembering, not just reading: the operators exposed their own network through a basic operational security mistake. A server misconfiguration left their infection logs, victim screenshots, and even their own custom WordPress management tool — a utility they’d built to control the compromised sites — sitting openly accessible. In trying to manage nearly 2,000 hacked sites at scale, the attackers accidentally infected themselves with their own tooling and handed researchers a direct window into the entire operation.
Why this should worry every WordPress site owner, not just the 2,000 already hit
The uncomfortable part of this story isn’t the 2,000 sites already compromised — it’s how ordinary those sites almost certainly were before the attack. Operations at this scale don’t hand-pick prestigious targets; they compromise whatever’s reachable through common, unpatched vulnerabilities and then repurpose it as infrastructure. A hacked site in a network like this doesn’t necessarily look hacked to its owner — no defacement, no obvious redirect, nothing that trips a casual glance. It just quietly serves a fake CAPTCHA to visitors, who then infect themselves, while the site itself keeps functioning normally for its owner.
That’s the pattern worth internalizing: a WordPress hack today is increasingly not about your site at all — it’s about turning your site into a tool used against someone else, with your business’s name and domain attached to it the entire time. If it’s ever traced back, that’s your reputation and your Google trust signals absorbing the damage for an attack you never even knew was running.
What to actually check
If you’ve noticed any CAPTCHA-style prompt on your site that doesn’t match what you actually installed, or any unfamiliar PowerShell-related instructions ever shown to a visitor, treat that as a serious, active compromise — not a glitch. Beyond that, this story is a good prompt to check the fundamentals covered in our Is My Site Hacked guide: unfamiliar admin accounts, files you didn’t create, and anything injected into pages that wasn’t there when you built them. Because this specific operation spread through common WordPress vulnerabilities at scale, keeping every plugin and theme patched remains the single highest-leverage thing you can do to avoid being the next entry in a network like this one.
If you want a proper check rather than a self-assessment, our malware removal and security service specifically looks for injected scripts and unauthorized content changes like the fake CAPTCHA prompts this operation relied on — the kind of infection built to be invisible to a site owner glancing at their own homepage.
FAQ
How would I know if my site is part of an operation like StopAndProtect? The clearest sign is any CAPTCHA, verification, or “prove you’re human” prompt on your site that you didn’t install yourself — especially one that asks a visitor to copy and run a command. Beyond that, the general hacked-site warning signs (unfamiliar admin accounts, unexpected files, injected scripts) apply here too.
Is ClickFix a WordPress-specific attack technique? No — ClickFix is a broader social-engineering technique that’s been used across many types of compromised websites, not just WordPress. WordPress sites are a common target for it specifically because of how many run outdated, exploitable plugins that give attackers an initial way in.
If my site was part of this network, am I legally liable for what happened to visitors? That’s a question for a lawyer familiar with your jurisdiction, not something we can answer generally — liability depends heavily on specific facts and local law. What we can say plainly: getting the infection fully removed and your site properly hardened afterward is the right first step regardless of how that legal question shakes out.