As reported by SecurityAffairs, Check Point Research has uncovered StopAndProtect — a cybercrime operation that weaponized approximately 2,000 compromised WordPress sites into a shared criminal infrastructure platform for malware delivery, data exfiltration, surveillance, and ransomware. First identified in May 2026, the campaign leverages the ClickFix fake-CAPTCHA social engineering technique to coerce victims into executing PowerShell commands, followed by a multi-stage loader chain deploying modular malware components.

Threat Alert: As reported by SecurityAffairs, Check Point Research has uncovered StopAndProtect — a cybercrime operation that weaponized approximately 2,000 compromised WordPress sites into a shared criminal infrastructure platform for malware delivery, data exfiltration, surveillance, and ransomware.

What makes this operation notable from a defender's perspective is not the individual techniques — ClickFix, PowerShell-based loaders, and modular ransomware are all well-documented — but the infrastructure model. The operators effectively built a decentralized, self-sustaining delivery network using other people's neglected websites. Each compromised WordPress instance served as a multi-purpose node: hosting malware payloads, acting as a C2 relay, receiving activity logs, and storing stolen documents. This is infrastructure-as-a-stolen-service.

The critical insight: your unpatched WordPress blog is not just a reputational risk to your organization. It is potential attack infrastructure that may be used to compromise someone else's network.

Why This Matters Beyond the Individual Site Owner

There is a persistent misconception in many organizations that a compromised marketing site, legacy blog, or forgotten subdomain represents a contained problem. StopAndProtect illustrates exactly why that assumption is dangerous. A single outdated WordPress installation — Check Point found one running a 2021 version with nearly 40 known vulnerabilities including SQL injection, authentication bypass, and arbitrary file upload — can be transformed into a node that delivers ransomware to an entirely unrelated victim.

This creates a collective risk problem. Organizations that diligently patch their internal systems may still find themselves compromised because an attacker delivered malware through a WordPress site belonging to a partner, vendor, or unrelated third party. The attack surface extends well beyond your own perimeter.

The Evasion Angle: Selective Theft Before Encryption

StopAndProtect departs from conventional ransomware playbooks. Rather than immediately encrypting everything, operators first enumerate file lists and selectively exfiltrate documents of interest. Encryption or screen-locking may follow — or may not, depending on what the attackers determine is most profitable. This exfiltration-first methodology means that traditional ransomware detection focused on mass file modification may not trigger until well after data theft has already occurred.

Defenders should note: if your detection strategy relies primarily on spotting rapid file encryption events, you are already late. Data loss may have happened in the preceding hours or days.

Shield53 Recommendations

Shield53 Recommendations
Audit your WordPress footprint immediately. Inventory every WordPress instance your organization owns or hosts — including forgotten subdomains, legacy marketing pages, and partner-managed sites. Identify any running versions or plugins more than 12 months out of date.
Enforce automatic updates for WordPress core and all plugins. Remove unused plugins and themes entirely rather than merely deactivating them. Disable PHP file execution in /wp-content/uploads/ where possible.
Implement web application firewall (WAF) protection in front of all public-facing CMS installations. Look for rules that block known exploitation patterns for SQL injection, authentication bypass, and arbitrary file upload vulnerabilities.
Deploy endpoint detection focused on PowerShell abuse. The ClickFix technique relies on victims executing attacker-controlled PowerShell. Constrain PowerShell execution policy, enable script block logging, and alert on encoded command execution or unexpected network connections originating from PowerShell processes.
Monitor for data exfiltration patterns — not just encryption. Alert on unusual outbound file transfers, large archive creation, and unexpected staging directories. StopAndProtect's selective theft model means exfiltration detection is your earliest opportunity to limit damage.
Engage your supply chain. If vendors or partners host WordPress sites linked to your organization, include CMS patching status in your third-party risk assessments. A partner's neglected blog can become your incident.

The broader lesson from StopAndProtect is that internet hygiene is a shared responsibility. Every unmaintained CMS installation is a potential weapon in someone else's arsenal. The cost of patching is trivial compared to the cost of becoming — knowingly or unknowingly — part of a criminal delivery network.