StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
A global cybercrime operation called StopAndProtect leverages nearly 2,000 hacked WordPress sites as infrastructure for malware distribution, command-and-control, and stolen data storage The attack chain begins with a ClickFix social engineering lure that triggers a PowerShell command, deploying a multi-stage .NET downloader/loader leading to a modular toolkit of six components The toolkit includes ransomware (SilentEncryptor), an SMB/USB worm (NetworkShareScanner), a VBS-based lateral movement
Analysis
TL;DR
- A global cybercrime operation called StopAndProtect leverages nearly 2,000 hacked WordPress sites as infrastructure for malware distribution, command-and-control, and stolen data storage
- The attack chain begins with a ClickFix social engineering lure that triggers a PowerShell command, deploying a multi-stage .NET downloader/loader leading to a modular toolkit of six components
- The toolkit includes ransomware (SilentEncryptor), an SMB/USB worm (NetworkShareScanner), a VBS-based lateral movement spreader, a LockScreen ransomware component, a custom chat utility (SimpleChatProxy), and a credential/file stealer (SilentDataCollector)
- Operators demonstrated sophisticated capabilities including WhatsApp automation for targeted data exfiltration, keylogging with email detection, and periodic screenshots, though operational security failures exposed internal tools and infection logs
- The WordPress compromise method involves a custom MU plugin that enables arbitrary PHP file uploads for remote code execution, after which the plugin self-deletes to evade detection
Why It Matters
This operation exemplifies the growing trend of threat actors treating compromised WordPress infrastructure as a multi-purpose platform—serving simultaneously as malware staging grounds, C2 servers, and data exfiltration endpoints—rather than relying on traditional hosting services. The modular, tool-kit approach to the attack chain, combined with automation capabilities for managing nearly 2,000 compromised sites, signals a professionalization of cybercrime operations that security teams should monitor closely.
Technical Details
- Infection chain: ClickFix fake CAPTCHA → PowerShell execution → Stage 1 .NET downloader (reports stats to C2) → Stage 2 .NET downloader/loader (sandbox checks, logging) → Stage 3 six-component toolkit
- Modular toolkit components: SilentEncryptor (selective or mass file encryption), NetworkShareScanner (SMB/USB worm for lateral spread), VBS spreader (removable media propagation and WMI-based network lateral movement), LockScreen (ransom note with QR code), SimpleChatProxy (operator-victim communication), SilentDataCollector (file enumeration and targeted exfiltration)
- Advanced stealer features: Keylogger with valid email detection, WhatsApp web and desktop automation (keyword-based contact search and screenshot capture), network share mapping/unmapping, screenshots every 30 seconds during victim inactivity
- WordPress compromise technique: ZIP archive containing "uploader-installer.php" creates a must-use (MU) plugin in wp-content/mu-plugins/, enabling arbitrary PHP file uploads for RCE; the plugin self-deactivates and self-deletes post-compromise; a separate "verify" plugin overlays fake CAPTCHA for non-Windows visitors and also self-deletes after activation via "activator.php"
- Operational security failures: Over 700 archives of stolen data uploaded to compromised sites between mid-May and end of July 2026, including the operators' own internal automation tool "fMain.frm" used to mass-manage compromised WordPress pages, along with detailed infection logs and victim screenshots
Industry Insight
- WordPress site operators and administrators should prioritize updating to the latest WordPress core and plugin versions, as many compromised sites ran versions from 2021 or earlier with dozens of known vulnerabilities; implementing automated update policies and monitoring for unauthorized MU plugins should be standard practice
- The dual use of compromised WordPress sites as both malware distribution points and data storage/exfiltration endpoints suggests organizations should audit their web infrastructure for anomalous PHP file uploads and unexpected mu-plugins directories, particularly on sites that appear to serve fake CAPTCHA challenges
- The integration of WhatsApp automation into the stealer toolkit reflects an evolving threat landscape where social media platforms are increasingly targeted for intelligence gathering; security awareness programs should address the risk of operators exploiting messaging app data, and endpoint detection strategies should account for automation-based screenshot and data capture techniques
Disclaimer: The above content is generated by AI and is for reference only.