In brief
- Check Point Research identified nearly 2,000 compromised WordPress sites used by the StopAndProtect malware operation.
- More than 6,000 unique IP addresses had been compromised as of July 24, including 1,852 in the United States.
- Researchers believe the attackers accidentally infected themselves, exposing internal files and tools used to manage compromised sites.
Nearly 2,000 hacked WordPress websites were used to distribute malware, steal data, monitor victims, and deploy ransomware, according to cybersecurity firm Check Point Research.
In the report published on Tuesday, researchers said the StopAndProtect ransomware family was first discovered in mid-May before tracing it to a broader operation. The hacked websites hosted malware, sent commands to infected computers, and stored stolen documents, screenshots, and activity logs.
Myriad: Who wins BLAST Open Porto 2026？ Click to make your prediction.
“The operation doesnt rely on a single piece of malware, but on a whole toolkit of criminal software working together,” Check Point researcher Jaromír Horejsi wrote. “Some components encrypt files, others silently steal documents or lock the screen, and another acts as a live chat between the attackers and their victims.”
According to Check Point, the malware targets Windows users and begins with a fake CAPTCHA on a compromised website. The ClickFix prompt instructs victims to run a PowerShell command that installs malware capable of stealing credentials, cryptocurrency wallet seed phrases, spreading through networks and USB drives, locking screens, and deploying ransomware.
The report did not say whether macOS and Linux users are affected.
However, mistakes by the attackers gave Check Point researchers a deeper look inside the operation, the company said.
“Operational security (OPSEC) failures by the developer exposed lots of files, including detailed infection logs from victims machines, screenshots from infected computers, and source code of tools the criminals use to mass-manage compromised websites,” Horejsi wrote.
By July 24, the campaign had compromised more than 6,000 unique IP addresses, including 1,852 in the United States and 630 each in Russia and India.
Exposed directories contained infection logs and screenshots from victims' computers. Researchers said they were able to collect over 31,000 screenshots between mid-May and the end of July, along with more than 700 archives containing stolen data, including documents, passwords, and cryptocurrency wallet files.
Check Point believes the threat actor also accidentally infected themselves.
“We collected a few hundred files exfiltrated from victims machines, and we believe that in one instance the threat actor infected themselves, as one archive contained several unusual files with suspicious content,” Horejsi wrote. “This also helps us better understand how the actor operates and how many compromised domains they likely control.”
ClickFix has surfaced in several other malware campaigns this year.
In May, an apparel website linked to FBI Director Kash Patel was taken offline after macOS visitors were reportedly targeted with ClickFix malware. Users were prompted to paste a command into Terminal that installed an infostealer capable of targeting browser data, session tokens, and crypto wallets.
In July, Jamf Threat Labs found ClickFix-style malware being distributed through a sponsored ad on X. The ad redirected users to a website that instructed them to open Terminal and run a command that installed a variant of the Atomic infostealer. In August, Microsoft researchers warned that hackers were using compromised websites and BNB Chain smart contracts to distribute malware through fake CAPTCHAs.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
Your Email
Get it!
Get it!