StopAndProtect Campaign Exploits Thousands of WordPress Sites for Malware Delivery

Cybersecurity researchers have uncovered a large-scale cybercrime campaign, dubbed StopAndProtect, that has compromised thousands of WordPress websites and repurposed them as infrastructure for malware delivery, command-and-control, and stolen-data storage.

The campaign primarily exploits outdated WordPress installations and vulnerable plugins to gain access to websites. Attackers then deploy malicious PHP scripts and a custom plugin that creates a hidden must-use plugin under the `wp-content/mu-plugins` directory. This provides persistent access and allows attackers to upload arbitrary files, including PHP files, to locations within the WordPress installation. Such functionality can enable remote code execution.

After compromising a website, attackers install a fake CAPTCHA plugin that displays a malicious ClickFix-style prompt to Windows visitors. Victims are tricked into copying and executing a PowerShell command, initiating a multi-stage infection involving .NET downloaders and loaders.

The final-stage toolkit includes ransomware, credential and file stealers, network and USB propagation tools, a lock-screen component, and a chat utility for attacker-victim communication. Researchers said the campaign does not always deploy ransomware, with attackers frequently prioritizing covert file collection and data theft.

The compromised WordPress infrastructure also stores stolen files, screenshots, and activity logs. More than 700 stolen archives were identified between May and July 2026, while more than 6,000 victim IP addresses had been observed by July 24.

The campaign highlights how poorly maintained websites can be transformed into distributed infrastructure for malware distribution, lateral movement, surveillance, and data exfiltration.

Attack Surface

Content Management System, Endpoint, Web Application, Endpoint OS, File Storage, Infrastructure, Server OS

Tactics

Initial Access, Execution, Persistence, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact

Techniques

• T1204.003 – User Execution: Malicious Image
• T1059.001 – Command and Scripting Interpreter: PowerShell
• T1027 – Obfuscated Files or Information
• T1027.009 – Obfuscated Files or Information: Embedded Payloads
• T1140 – Deobfuscate/Decode Files or Information
• T1620 – Reflective Code Loading
• T1497 – Virtualization/Sandbox Evasion
• T1036 – Masquerading
• T1547 – Boot or Logon Autostart Execution
• T1555 – Credentials from Password Stores
• T1082 – System Information Discovery
• T1083 – File and Directory Discovery
• T1080 – Taint Shared Content
• T1091 – Replication Through Removable Media
• T1113 – Screen Capture
• T1005 – Data from Local System
• T1071.001 – Application Layer Protocol: Web Protocols
• T1102 – Web Service
• T1567.002 – Exfiltration Over Web Service: Exfiltration to Cloud Storage
• T1486 – Data Encrypted for Impact
• T1490 – Inhibit System Recovery
• T1489 – Service Stop

SuperPRO's Threat Countermeasures Procedures

1. Keep WordPress and all installed plugins updated to the latest supported versions and promptly apply security patches.
2. Remove outdated, unsupported, and unused plugins or themes that could expose known vulnerabilities.
3. Restrict WordPress administrator accounts and enforce strong, unique passwords with multi-factor authentication.
4. Monitor the wp-content/mu-plugins directory for unauthorized or unexpected PHP files, as attackers can abuse must-use plugins for persistence.
5. Restrict file upload functionality and prevent unauthorized users from uploading executable PHP files to the web server.
6. Monitor web server and WordPress logs for suspicious file uploads, plugin activation, administrator logins, and unexpected PHP execution.
7. Deploy web application firewalls and endpoint protection to detect malicious requests, exploitation attempts, PowerShell execution, and suspicious outbound connections.
8. Implement network monitoring and egress controls to identify compromised websites communicating with suspicious external infrastructure or transferring unusual volumes of data.
9. Regularly scan WordPress infrastructure for known vulnerabilities and indicators of compromise and investigate unexpected files, plugins, scheduled tasks, and administrator accounts.