CHECK Point Research has uncovered a cybercrime operation dubbed StopAndProtect that has turned nearly two thousand compromised WordPress websites into a platform for malware distribution, data theft and ransomware according to their report.
The ClickFix technique presents a bogus verification box that instructs the user to copy and run a line of code in Windows PowerShell as detailed by Security Affairs here. Running the code downloads a payload that includes ransomware for file encryption, an information stealer for documents and credentials, and a backdoor that lets attackers issue further commands. Investigators found that the compromised sites were running outdated versions of WordPress, its themes or plugins, which allowed the initial foothold.
Check Point said the operation has mostly affected victims in the United States, Russia and India, with infection logs exposed by a server mistake showing thousands of compromised machines per DataBreaches.net. Although the researchers did not link the activity to a known threat group, the leaked data revealed the scale of the campaign and the variety of payloads deployed. No CVEs were directly referenced in the report, highlighting that the attackers relied on unpatched flaws rather than a single disclosed vulnerability.
Site owners should update WordPress core, themes and plugins to the latest stable releases and enforce strong, unique passwords for all administrative accounts as advised by The Hacker News. Deploying a web application firewall can help block requests that attempt to inject the malicious CAPTCHA script into pages. End users ought to treat any prompt that asks them to run PowerShell commands as suspicious, even if it appears as a security check or verification step.
Administrators can review outbound traffic for connections to known command-and-control servers and disable PowerShell execution policies on systems where the shell is not required. Maintaining regular offline backups and segmenting networks limits the damage if ransomware manages to encrypt files. Subscribing to reputable threat intelligence feeds enables early detection of similar ClickFix abuse and helps defenders adapt their controls.