StopAndProtect: Nearly 2,000 Hacked WordPress Sites Weaponized as Criminal Infrastructure

StopAndProtect is a global cybercrime operation that turns thousands of hacked WordPress websites into working attacker infrastructure for spreading malware, controlling infected machines, and storing stolen documents, screenshots, and activity logs. It preys on outdated WordPress sites running years-old cores and vulnerable plugins. Attackers install a custom plugin via a ZIP-packaged PHP file, uploader-installer.php, which drops a must-use (MU) plugin into the wp-content/mu-plugins directory, letting anyone with valid credentials upload arbitrary files, including PHP, almost anywhere under the web root and enabling remote code execution. The plugin then self-deletes to avoid detection, and the compromised site serves visitors a fake ClickFix-style CAPTCHA that tricks them into running a PowerShell command to start the infection.

That PowerShell command launches a staged .NET chain: a stage-1 downloader reports victim statistics to the command-and-control (C2) server, and a stage-2 loader adds sandbox checks before launching the payloads. Stage 3 unpacks six components: SilentEncryptor (file encryption), NetworkShareScanner (an SMB/USB worm), a VBS spreader, LockScreen (blocks user input and shows a ransom message with a payment QR code), SimpleChatProxy (a victim-to-operator chat tool), and SilentDataCollector (the stealer). Ransomware is not always deployed; in most cases, StopAndProtect operators quietly harvest file lists and then specific documents.

Several StopAndProtect components are built to spread. NetworkShareScanner behaves like an SMB/USB worm, while the VBS spreader propagates to hard disks and removable media, scans the network, and moves laterally via Windows Management Instrumentation (WMI). Newer stealer builds can also map and unmap network shares, extending reach across connected systems.

SilentDataCollector enumerates all drives, encrypts the resulting list, and sends it to the C2, after which operators can upload a command file directing it to grab specific files. Newer versions add a keylogger with valid-email detection, WhatsApp data theft, and screenshots taken every 30 seconds. Stolen data is uploaded back to the hacked WordPress sites, more than 700 archives between mid-May and the end of July 2026, and operator security failures exposed those logs, screenshots, and even the attackers' own management tool, fMain.frm, after they apparently infected themselves.