A sprawling cybercrime campaign has converted close to 2,000 hacked WordPress websites into a distributed criminal network used to spread malware, harvest sensitive files, and deploy ransomware, according to new research from Check Point Research.
The operation, dubbed StopAndProtect after a ransomware family first spotted in mid-May, targets Windows users through fake CAPTCHA prompts on compromised sites. Visitors are instructed to run a PowerShell command that initiates a multi-stage infection chain, ultimately loading a toolkit of malicious components that includes ransomware, a credential stealer, a network worm, and a live chat utility for communicating with victims.
“The operation doesn’t rely on a single piece of malware, but on a whole toolkit of criminal software working together,” Check Point researcher Jaromír Horejsi wrote in the report published Tuesday. “Some components encrypt files, others silently steal documents or lock the screen, and another acts as a live chat between the attackers and their victims.”
By July 24, the campaign had compromised more than 6,000 unique IP addresses, including 1,852 in the United States and 630 each in Russia and India. Researchers collected over 31,000 screenshots from infected machines between mid-May and the end of July, along with more than 700 archives containing stolen documents, passwords, and cryptocurrency wallet files.
Most of the hijacked websites were running outdated versions of WordPress and vulnerable plugins. One compromised site, for instance, was still operating on a WordPress version from 2021, leaving it exposed to roughly 40 different vulnerabilities.
The infection chain begins when a visitor to a compromised site encounters a fake ClickFix-style CAPTCHA. The prompt instructs the user to copy and execute a PowerShell command, which downloads a stage-one .NET downloader. That component reports statistics to the command-and-control server and loads a second-stage downloader with sandbox checks and additional logging capabilities. The second stage then launches the main payloads.
Those payloads include SilentEncryptor, which encrypts files on infected computers or targets specific hostnames; NetworkShareScanner, an SMB/USB worm that spreads to other devices; a VBS spreader that propagates across networks and removable media; LockScreen, which blocks user input and displays a ransom message with a payment QR code; SimpleChatProxy, a custom chat application for victim-operator communication; and SilentDataCollector, which generates an encrypted list of all drives and exfiltrates it to the C2 server.
Newer versions of the stealer add a keylogger with email address detection, the ability to harvest data from WhatsApp, and screenshot capture every 30 seconds. Operators can issue specific search keywords for WhatsApp contacts, and the stealer waits until the victim is inactive before automating the desktop or web version of the app to open contact information and take a screenshot.
Check Point said the operation does not always result in ransomware deployment. In most cases, the threat actors have been observed covertly stealing file lists and then exfiltrating specific files from compromised systems.
The compromised WordPress sites serve three primary functions: hosting malware stages, acting as command-and-control servers to send instructions, and storing logs exfiltrated from victims.
Operational security failures by the developers gave researchers an unusually detailed view into the operation. Exposed directories contained infection logs, screenshots, and even source code for tools used to mass-manage the compromised websites. One archive contained internal development files that suggest the threat actor accidentally infected their own machine, including a custom automation utility called fMain.frm used to manage the botnet of hijacked WordPress pages.
“This automation tool allows the botnet operator to mass-manage compromised WordPress pages,” Check Point said. “It uses secure upload and delete PHP scripts on compromised websites to upload or delete additional files, activate or deactivate fake-captcha ClickFix, activate or deactivate caching, etc.”
To maintain control over the sites, the attackers install a custom WordPress plugin via a ZIP archive containing a PHP file called uploader-installer.php. The plugin creates a must-use plugin file in the wp-content/mu-plugins directory, allowing anyone with valid credentials to upload arbitrary files, including PHP files, to almost any path under the WordPress root. Once the site has been modified, the plugin deactivates and deletes itself to avoid detection.
The compromised sites also contain a malicious verify plugin that overlays original content with a fake CAPTCHA for non-Windows visitors. The plugin is activated after the threat actor uploads a file called activator.php, after which it deletes itself.
ClickFix has appeared in several other malware campaigns this year. In May, an apparel website linked to FBI Director Kash Patel was taken offline after macOS visitors were reportedly targeted with ClickFix malware that prompted users to paste a command into Terminal, installing an infostealer capable of harvesting browser data, session tokens, and crypto wallets.
In July, Jamf Threat Labs found ClickFix-style malware distributed through a sponsored ad on X. The ad redirected users to a website instructing them to open Terminal and run a command that installed a variant of the Atomic infostealer. In August, Microsoft researchers warned that hackers were using compromised websites and BNB Chain smart contracts to distribute malware through fake CAPTCHAs.
Check Point’s Eli Smadja urged organizations to be cautious of unexpected CAPTCHA prompts that instruct users to copy, paste, or run commands, to keep devices and security software updated, and to immediately leave any website that asks them to perform unusual steps outside the browser.
“StopAndProtect shows how attackers can turn thousands of poorly maintained WordPress sites into a distributed criminal infrastructure for malware delivery, surveillance, data theft, and ransomware,” Smadja said.
Click Here For The Original Source.
