StopAndProtect Malware Campaign Infects Thousands of Devices Through Compromised WordPress Sites

A sophisticated cybercrime operation has compromised nearly 2,000 WordPress sites to distribute malware that steals sensitive data from Windows computers. The group, identified as StopAndProtect by Check Point Research, used legitimate domains to host payloads and redirect instructions to infected devices.

The malware's propagation tactic relies on fake CAPTCHA pages, tricking users into running malicious PowerShell commands on their devices. This allows attackers to extract saved passwords, wallet seeds, and other sensitive data from compromised devices.

According to Check Point Research, between May and July, the campaign infected over 6,000 unique IP addresses and collected more than 700 stolen data files from victims. The most recent versions of the malware also log keystrokes, capture screenshots every 30 seconds, copy files from shared folders, and even encrypt devices to demand payment as ransomware.

The attackers' own mistakes have provided valuable intelligence about the campaign. Poor security practices left directories and log files exposed on the web, including the source code of an automation tool written in Visual Basic 6 that allowed attackers to remotely control hacked sites.