StopAndProtect malware hits 2,000 hacked WordPress sites worldwide

A server error by cybercriminals has revealed a global malware scheme called StopAndProtect, which utilized nearly 2,000 compromised WordPress sites to infect computers, steal files, and deploy ransomware. Check Point Research noted the ransomware component in May 2026 and discovered a complete malware toolkit being distributed via the hacked websites. Users who visited the infected sites were tricked into executing a PowerShell command under the pretense of completing a fake CAPTCHA, a method known as ClickFix.