StopAndProtect Used WordPress as Campaign Infrastructure
Check Point Research linked StopAndProtect to a broader operation in the middle of May 2026, with text files listing close to 2,000 compromised WordPress domains. The group’s activity was not limited to a single ransomware strain: hacked sites were being used to host malware stages, pass commands, and store logs pulled from victims.
The infection starts with a fake CAPTCHA or “fix this” prompt that tricks a user into running a PowerShell command. That kicks off .NET downloaders and loaders, then later components such as ransomware, a worm, a credential stealer, and other spreaders. In many cases, Check Point says the operators skip immediate encryption and instead silently collect file lists and selected files, which means they can watch the compromise unfold and choose what to take.
For WordPress owners, the exposure is not just a defaced site but campaign infrastructure living on their server; for Windows responders, the same operation can begin with a user pasting one command and end with staged theft rather than loud encryption. The reporting still leaves the full scale of the victim set open, but it shows that compromised WordPress hosting can extend an intrusion’s reach long after the first endpoint is touched.