A cybercrime operation called StopAndProtect has weaponized nearly 2,000 compromised WordPress websites to distribute malware, siphon cryptocurrency wallet files, and deploy ransomware against victims across the US, Russia, and India. Check Point Research published a comprehensive report on August 18 detailing the campaign, which was first spotted in mid-May 2026 and has since ballooned into one of the more brazen web-infrastructure hijacking schemes in recent memory.
The operation infected over 6,000 unique IP addresses through a deceptively simple trick: fake CAPTCHA prompts that convince visitors to run malicious PowerShell commands on their own machines.
How the attack chain works
StopAndProtect relies on a social-engineering technique called ClickFix. When an unsuspecting user lands on one of the compromised WordPress sites, they encounter what looks like a standard CAPTCHA verification page. Instead of clicking squares with traffic lights, though, victims are prompted to execute a PowerShell command, which kicks off a multi-stage infection process.
That initial command downloads a .NET loader, which then pulls in a suite of malware components. These include credential stealers, obfuscation tools designed to dodge antivirus detection, and modules specifically built to locate and exfiltrate crypto wallet files. The compromised WordPress sites don’t just serve as the initial bait. They also function as command-and-control servers and data storage repositories for stolen information.
