Infrastructure · 18 Aug 2026 · Rob Nidschelm

Your WordPress Site Wasn’t the Victim. It Became the Attacker’s Infrastructure.

A compromised website is usually treated as the end of an incident: clean the files, reset credentials, restore the page and move on. The StopAndProtect operation shows why that model is incomplete. Almost 2,000 hijacked WordPress domains were not merely defaced or used to redirect visitors. They became a distributed criminal platform for malware delivery, command and control, surveillance, data theft and ransomware.

Check Point Research disclosed the operation on 18 August 2026 after first identifying a related ransomware family in mid-May. The researchers found a multi-stage Windows infection chain that began with a fake CAPTCHA and used compromised WordPress sites at nearly every step.

The website became the supply line

Visitors to a compromised site could be shown a ClickFix-style prompt that instructed them to copy and run a PowerShell command. That command fetched additional scripts and in-memory .NET components. Later stages could deliver an encryptor, an SMB and USB worm, a VBS spreader, a screen locker, an operator chat utility and a data collector.

The ransomware component was not deployed to every infected system. In many cases, the operation silently enumerated files and let the operator select material for collection. Newer versions could log keystrokes, take screenshots every 30 seconds while a user was active, map network shares and automate searches for WhatsApp contacts.

The WordPress sites supplied more than the initial lure. They hosted payload stages, returned instructions to infected machines and received exfiltrated logs, screenshots and stolen archives. From mid-May through the end of July, Check Point collected more than 700 archives and approximately 31,000 screenshots from exposed attacker-controlled directories.

Persistence hid outside the normal plugin list

One recovered installer created wp-content/mu-plugins/wp-sec.php, a WordPress must-use plugin. MU plugins load automatically on every request and do not appear like ordinary extensions in the standard Plugins screen.

The malicious plugin registered a hidden REST route at wp-sec/v1/upload. Requests authenticated with hardcoded credentials could write files, including PHP, to almost any location under the WordPress root. The installer then deactivated and deleted itself, leaving the persistent component behind.

That detail matters operationally. An administrator can review the visible plugin list, remove an obviously malicious extension and still miss the component that gives the operator a remote file-write capability. A clean dashboard is not evidence of a clean server.

Scale came from neglected trust

The researchers found files listing close to 2,000 compromised domains and internal logs associated with more than 6,000 unique IP addresses as of 24 July. Those figures are not a precise victim count. They include research systems and limited views from exposed infrastructure. They are still strong evidence of an operation built for scale.

Check Point did not identify one universal WordPress vulnerability behind every compromise. One sampled site ran a WordPress release from 2021 and exposed almost 40 known weaknesses across the installation. The campaign’s advantage came from an ecosystem of forgotten sites, outdated plugins and weak maintenance, not a single magic exploit.

Compromised legitimate domains also create a defensive problem. Traffic to a customer’s website or a small supplier may look less suspicious than traffic to newly registered attacker infrastructure. Reputation controls alone cannot distinguish a trusted site from a trusted site that has become a payload host.

What defenders should inspect

• Audit the filesystem, not only wp-admin. Inspect wp-content/mu-plugins, unexpected PHP files, recent file modifications, web shells, uploaders and unfamiliar REST routes.
• Hunt for the StopAndProtect paths. Look for wp-sec.php, the route wp-sec/v1/upload, a verify plugin, store.php, proxy.php, stored_url.txt, wp-cssv.php and wp-verifyup.php. Names can change, so also detect the behaviours.
• Review web logs for file-write and staging activity. Correlate REST requests, new PHP files, unexpected ZIP archives, large uploads and outbound requests from the web server.
• Rebuild where integrity is uncertain. Replace core files and plugins from trusted sources, rotate WordPress, database, hosting and deployment credentials, invalidate sessions, and check neighbouring sites on the same account.
• Protect visitors and endpoints. Treat any CAPTCHA that asks a user to open Run, paste a command or execute PowerShell as malicious. Endpoint controls should alert on hidden PowerShell download cradles and .NET assemblies loaded directly into memory.
• Separate hosting risk from business trust. Outbound filtering, browser isolation and content controls should consider that an established partner site can serve malicious content after compromise.

The victim boundary moved

StopAndProtect is significant because it shifts the security consequence of a poorly maintained website. The site’s owner may see no obvious outage and may not be the operator’s final target. The compromised host can instead attack visitors, relay commands and store another organisation’s stolen data.

For defenders, the lesson is uncomfortable but useful: website security is part of endpoint and supply-chain security. A neglected CMS can become someone else’s infrastructure while continuing to serve its normal pages.

Sources

• Check Point Research, Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect, published 18 August 2026. No publication time was provided.
• The Hacker News, StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data, published 19 August 2026. No publication time was provided.
• TechRadar Pro, Experts warn 2,000 hacked WordPress sites were secretly running a global crime ring, published 22 August 2026 at 13:05 UTC.