StopAndProtect operation exploits nearly 2,000 hacked WordPress sites to steal crypto wallets

A cybercrime operation called StopAndProtect has weaponized nearly 2,000 compromised WordPress websites to distribute malware, siphon cryptocurrency wallet files, and deploy ransomware against victims across the US, Russia, and India. Check Point Research published a comprehensive report on August 18 detailing the campaign, which was first spotted in mid-May 2026 and has since ballooned into one of the more brazen web-infrastructure hijacking schemes in recent memory. The operation infected over 6,000 unique IP addresses through a deceptively simple trick: fake CAPTCHA prompts that convince visitors to run malicious PowerShell commands on their own machines. How the attack chain works StopAndProtect relies on a social-engineering technique called ClickFix. When an unsuspecting user lands on one of the compromised WordPress sites, they encounter what looks like a standard CAPTCHA verification page. Instead of clicking squares with traffic lights, though, victims are prompted to execute a PowerShell command, which kicks off a multi-stage infection process. That initial command downloads a .NET loader, which then pulls in a suite of malware components. These include credential stealer...