A new malware campaign dubbed StopAndProtect has hijacked nearly two thousand WordPress sites to spread ransomware and steal credentials, according to a report from The Hacker News. The operation primarily targets organisations in the United States, Russia and India, turning trusted domains into launchpads for further attacks.
The infection chain starts with a social engineering lure presented as a ClickFix prompt that tricks site administrators into executing a malicious PowerShell script. This script then downloads a payload bundle that includes a ransomware module, information stealers and tools for maintaining persistence on the compromised host. Because the campaign does not rely on a known software flaw, attackers instead abuse weak or stolen login credentials to gain administrative access to outdated WordPress installations.
Researchers noted that the affected sites were running old versions of the WordPress core, themes or plugins that had not been updated for months or even years. No CVE identifiers have been assigned to the activity, highlighting how threat actors can achieve impact without exploiting a publicly disclosed vulnerability. The use of legitimate‑looking web pages helps the malware bypass reputation‑based filters and reach a wider audience.
Check Point’s analysis, detailed in their research, revealed that the attackers left extensive infection logs and screenshots exposed on compromised servers, providing a rare view into the campaign’s scale and tactics. Victims were observed across multiple continents, with the highest concentration in North America, Eastern Europe and South Asia. Despite the breadth of the operation, no specific threat actor group has been publicly attributed to the StopAndProtect effort.
The incident highlights the continued danger posed by neglected content management systems, especially when combined with social engineering that sidesteps technical defences. It also shows how compromised legitimate domains can be weaponised at scale to distribute ransomware and harvest sensitive data without raising immediate alarms.
Defenders should ensure that all WordPress instances are running the latest stable release and that themes and plugins are updated regularly, removing any that are no longer supported. Enforcing strong, unique passwords and enabling multi‑factor authentication for admin accounts can reduce the risk of credential theft. Monitoring for unexpected PowerShell execution, restricting script execution policies and deploying a web application firewall to filter suspicious requests are also advisable steps.
Finally, educating users about the dangers of unsolicited prompts and links remains a critical layer of defence against campaigns like StopAndProtect.