2,000 hacked WordPress sites turned into criminal infrastructure

A global cybercrime operation dubbed StopAndProtect has been uncovered, using nearly 2,000 hacked WordPress websites as its entire infrastructure to distribute malware, steal data, and deploy ransomware. The investigation, led by cybersecurity firm Check Point Research, revealed that the operation infected more than 6,000 unique IP addresses worldwide as of July 24, 2026, with the United States, Russia, and India being the most affected countries.

The operation, first identified in mid-May 2026, exploited the widespread use of WordPress, which powers approximately 43% of websites globally. Attackers hijacked legitimate, poorly maintained WordPress sites by exploiting vulnerabilities in both the core software and third-party plugins. Instead of using dedicated servers, they turned these compromised domains into a distributed criminal network for hosting malware payloads, issuing commands to infected computers, and storing stolen data.

The attack chain begins with a social engineering tactic known as ClickFix. Visitors to a compromised site are presented with a fake CAPTCHA prompt, which instructs them to copy and execute a malicious PowerShell command on their Windows device....