Feed›Malware›2,000 WordPress sites hijacked by StopAndProtect malware ope...
MalwareCyber Insider
8.0 — CRITICAL

2,000 WordPress sites hijacked by StopAndProtect malware operation

📅 19 August 2026 at 16:22 UTC📰 Cyber InsiderView original source ↗
2,000 WordPress sites hijacked by StopAndProtect malware operation

A large-scale malware operation dubbed StopAndProtect uses thousands of compromised WordPress websites to distribute malware, issue commands, and store data stolen from infected computers. The campaign combines ransomware, credential theft, surveillance, lateral movement, and hands-on data collection, with logs revealing more than 6,000 unique IP addresses linked to infections. The operation was discovered by Check … The post 2,000 WordPress sites hijacked by StopAndProtect malware operation appeared first on CyberInsider.

🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview

A large-scale malware operation, StopAndProtect, hijacked over 2,000 WordPress sites to distribute malware and steal data from infected computers, combining ransomware, credential theft, surveillance, lateral movement, and hands-on data collection.

⚙️Technical Details
Affected Systems
Compromised WordPress websitesInfected computers
Attack Vectors
Fake CAPTCHA using ClickFix social-engineering techniqueMalicious PowerShell command copied to clipboardMulti-stage infection chain involving PowerShell scripts, .NET downloaders and loaders, and specialized payloads
💥Impact Assessment
Severity: High
Who Is at Risk
WordPress administrators and users of compromised websites
🛡️Recommended Actions
1Keep WordPress CMS and all plugins updated
2Remove abandoned extensions
3Inspect wp-content/mu-plugins for unexpected files

Read the full article

This is a curated summary. The complete article is available at Cyber Insider.

Read on Cyber Insider ↗
← Back to feed