Nearly 2,000 Hacked WordPress Sites Turned Into Criminal Infrastructure
Nearly 2,000 hacked WordPress sites were used in a malware campaign tied to StopAndProtect ransomware. The compromised sites served as malware hosts, command channels, and storage for stolen files, screenshots, and logs. The attack mainly targeted Windows users with fake CAPTCHA pages that pushed a “ClickFix” prompt, tricking victims into running a PowerShell command that installed malware for credential theft, crypto wallet seed theft, network/USB spreading, screen locking, and ransomware deployment. Operational mistakes exposed parts of the infrastructure, including infection logs, victim screenshots, stolen archives, and source code for mass-managing compromised sites. By July 24, the campaign had reached over 6,000 unique IP addresses, with major concentrations in the U.S., Russia, and India. Researchers collected more than 31,000 screenshots and over 700 archives of stolen data. Similar ClickFix tactics have appeared in other recent campaigns.
