StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
- ID
- 15578
- Status
- summarized
- Published
- 19 Aug 2026, 7:25 PM
- Fetched
- 19 Aug 2026, 8:37 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/stopandprotect-uses-nearly-2000-hacked.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 4.5
- Created
- 19 Aug 2026, 8:39 PM
- Tags
- Audience
- developerssaas_founders
What happened
Check Point Research uncovered a cybercrime operation dubbed StopAndProtect that has compromised nearly 2,000 WordPress sites—most running outdated WordPress versions and plugins—to serve as malware hosting, C2 servers, and exfiltrated-data storage. The campaign uses ClickFix social engineering (fake CAPTCHA prompts) to trigger PowerShell execution, deploying a toolkit including ransomware, credential stealers, SMB/USB worms, and screen lockers, though data theft is more common than ransomware deployment.
Why it matters
If you or your clients run WordPress, patch core and plugins immediately—compromised sites here were running versions from 2021 with ~40 known vulnerabilities. For builders using WordPress as a marketing or docs site alongside a SaaS product, this is a reminder that neglected WordPress instances become attack infrastructure that can harm your visitors and reputation.
Discussion angle
How many of us maintain WordPress sites for side projects or client work, and what's the minimum viable patching and monitoring routine that prevents your site from becoming someone else's C2 server?