Study reveals 5,000 computers infected via WordPress sites
Check Point's StopAndProtect investigation found hijacked sites hosting malware and stolen data
Check Point Research has uncovered a global cybercrime operation that quietly ran its entire infrastructure through nearly 2,000 hacked WordPress websites.
The investigation, known as StopAndProtect, traced a network of more than 5,000 infected computers worldwide back to a toolkit of malware hosted on compromised, otherwise ordinary WordPress domains.
Why did WordPress make such an easy target?
WordPress is the most extensively used content management system today, as it controls about 43% of websites worldwide. However, what makes WordPress accessible is that the CMS can be easily installed because of installation scripts and web builder plug-ins.
According to the researchers, the owners of the ring were able to hijack legitimate websites through exploitation of vulnerabilities of both the core WordPress installation and third-party plug-ins and use them for their own criminal purposes without creating any suspicious infrastructure.
The attack chain starts with a misleading CAPTCHA message presented to visitors on the compromised website through social engineering exploitation called ClickFix, which forces the victim to copy and execute a harmful PowerShell command himself.
Subsequently, multiple downloaders are used to deliver a whole kit of cybercriminals' software instead of one type of malware, namely, SilentEncryptor ransomware, a worm that scans the network, a screenlocker, and a stealer that is capable of stealing credentials and cryptocurrency wallets.
As Eli Smadja from Check Point stated, "how attackers can turn thousands of poorly maintained WordPress sites into a distributed criminal infrastructure for malware delivery, surveillance, data theft, and ransomware."
The StopAndProtect name was initially coined by Check Point for the ransomware part of the attack only after they first observed the malware in May 2026.
The name was later extended to refer to the whole process once researchers figured out that not all victims were subjected to a ransomware attack but some attackers stealthily stole particular files based on reconnaissance.
The investigation itself only became possible because the criminals made mistakes. Exposed servers and open directory listings let researchers inspect victim logs, screenshots, internal management tools, and source code the attackers used to control hijacked domains at scale, including one instance where an operator appears to have infected their own machine and accidentally uploaded internal development files.
Among the compromised sites, Check Point identified one running a WordPress installation more than five years out of date, carrying roughly 40 unresolved vulnerabilities.
Smadja urged organisations to treat unexpected CAPTCHA prompts asking them to copy, paste, or run commands as a red flag and to leave immediately any site requesting unusual steps outside the browser.
