Cybercriminals used close to 2,000 compromised WordPress websites to distribute malware, control infected computers, and store stolen information. The discovery shows how an outdated website can become part of a much larger criminal operation without its owner realizing it.
Check Point Research disclosed the operation, named StopAndProtect, on August 18, 2026. The campaign combined ransomware, credential theft, file exfiltration, screen locking, and several methods for spreading between computers.
WordPress sites were not necessarily the campaign’s final targets. Attackers repurposed them as infrastructure for reaching and controlling other victims.
What Did Check Point Discover?
Check Point first encountered the StopAndProtect ransomware family in May 2026. Further investigation showed that the ransomware formed only one part of a broader malware toolkit.
The operation started with a fake CAPTCHA using a social-engineering method known as ClickFix. Visitors were instructed to copy or execute a PowerShell command under the impression that they were completing a verification step.
Executing the command downloaded several malware stages. These components could encrypt files, steal credentials and documents, spread through USB devices or Windows file sharing, lock the victim’s screen, and open a chat channel between the attacker and victim. Check Point collected approximately 31,000 screenshots from exposed directories between mid-May and the end of July. Researchers also found more than 700 archives containing data taken from infected computers.
The campaign’s own operational mistakes exposed its scale. Files recovered from the infrastructure contained lists approaching 2,000 compromised WordPress domains and source code for tools used to manage those sites in bulk. Check Point described the lists as an indication of the operation’s size rather than a complete count of every active compromised site.
Read Check Point Research here.
How Were the WordPress Sites Used?
Скомпрометированный WordPress sites distributed malware stages, passed commands to infected computers, and stored activity logs and stolen files. This distributed structure gave the attackers many separate domains from which to operate.
Check Point also recovered an installer for a malicious must-use WordPress plugin. Must-use plugins load automatically and do not appear in the normal plugin list in the same way as standard plugins.
The malicious plugin created a hidden REST API endpoint with hardcoded credentials. An attacker who knew those credentials could upload files, including executable PHP files, into the WordPress installation. The installer then deactivated and deleted itself to make the change harder to notice.
One compromised site examined by Check Point ran a WordPress version dating from 2021. The researchers identified nearly 40 potential vulnerabilities involving outdated software, expired certificates, SQL injection, authentication bypasses, file uploads, and other weaknesses.
This single example does not prove that every site in the operation was compromised through the same vulnerability. It does show how several years of missed maintenance can leave multiple possible entry points open.
Could Better WordPress Hosting Have Prevented This?
A управляемого WordPress кашель can reduce the risk, but no hosting plan can remove it completely. WordPress security depends on the host, the application, installed plugins, account credentials, and the site owner’s maintenance practices.
Автоматический WordPress updates can close known core vulnerabilities. Plugin vulnerability monitoring can identify outdated or abandoned extensions. A web application firewall filters suspicious requests before they reach WordPress, while malware scanning checks files for known or unusual code.
Runtime protection adds another layer by monitoring what PHP code attempts to do during execution. Account isolation can also limit how far an attacker moves when one website on a shared server becomes compromised.
These controls only work within their defined scope. A firewall may miss valid-looking requests that exploit a new vulnerability. A malware scanner may also fail to recognize a new or heavily modified payload. Backups help restore a website, but a backup created after the compromise may already contain malicious files.
Что должно WordPress Site Owners Check?
WordPress site owners should update WordPress core, plugins, and themes, then remove extensions that are no longer used. An inactive but vulnerable plugin can remain a security risk if its files stay on the server.
Site administrators should also review user accounts, rotate passwords, enable two-factor authentication, and check the wp-content/mu-plugins directory for unfamiliar files. Security logs may reveal unexpected administrator creation, file uploads, REST API activity, or changes to caching plugins.
Offsite backups should store clean copies outside the hosting account. Website owners also need to test the restore process instead of assuming that an available backup is usable.
The StopAndProtect campaign does not mean WordPress itself is inherently unsafe. It shows that an unmaintained WordPress installation can become infrastructure for attacks against people far beyond the original website.
