Reported by 3 outlets

Timeline

1. update from malware.news

   Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect

   malware.news · 56d ago · August 18th, 2026

   Research by: Jaromír Hořejší ( @JaromirHorejsi ) Key points StopAndProtect is a newly identified operation that combines file encryption with data theft. The criminals abuse thousands of hacked WordPress websites as their infrastructure – using them to spread the malware, control infected machines, and store stolen documents, screenshots, and activity logs (records created by malware to track its actions, progress, or status during execution). Operational security (OPSEC) failures by the developer exposed lots of files, including detailed infection logs from victims’ machines, screenshots from infected computers, and source code of tools the criminals use to mass-manage compromised websites. Internal logs reveal thousands of IP addresses affected by this operation, underscoring that this is not a small, isolated incident but a large-scale campaign that targets victims across many regions and networks, where most IPs belong to the US, Russia, and India. The operation doesn’t rely on a single piece of malware, but on a whole toolkit of criminal software working together – some components encrypt files, others silently steal documents or lock the screen, and another acts as a live chat between the attacke

2. update from gbhackers.com

   Hackers Abuse Thousands of WordPress Sites to Spread StopAndProtect Malware via ClickFix

   gbhackers.com · 55d ago · August 19th, 2026

   A large-scale malware operation called StopAndProtect is exploiting thousands of compromised WordPress websites to distribute ransomware, steal files, harvest credentials, and remotely monitor victims through deceptive ClickFix CAPTCHA prompts. Researchers first identified the campaign in mid-May 2026. They discovered that the operation utilizes a broad range of criminal tools rather than relying on a single […] The post Hackers Abuse Thousands of WordPress Sites to Spread StopAndProtect Malware via ClickFix appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from cyberpress.org

   Hackers Turn Thousands of WordPress Sites Into StopAndProtect Malware Infrastructure

   cyberpress.org · 55d ago · August 19th, 2026

   A newly uncovered cybercrime operation, dubbed StopAndProtect, has transformed thousands of compromised WordPress websites into a distributed infrastructure for malware delivery, command-and-control communications, and the storage of stolen data. Checkpoint first observed the campaign in mid-May 2026 and found that it blends ransomware activity with targeted data theft, enabling operators to decide whether to encrypt victims’ files, silently collect documents, or do both. The campaign begins with a ClickFix social-engineering lure hosted on hacked websites. Visitors are shown a fake CAPTCHA prompt that instructs them to copy and run a PowerShell command. Hackers Turn Thousands of WordPress Sites Once executed, the command launches a hidden PowerShell process, downloads additional payloads, and starts a multi-stage infection chain. The sequence progresses from PowerShell scripts to .NET loaders, then deploys functional malware modules onto the victim’s system. StopAndProtect’s malware toolkit includes a ransomware component known as SilentEncryptor, a credential and data stealer called SilentDataCollector, a lock-screen payload, a custom chat tool, and propagation components capable of moving through SMB shares, USB devices, WMI, and removable media. Attack Flow (Source: CheckPoint) This modular design gives the attackers flexibility. Rather than automatically encrypting every infected endpoint, operators can collect file inventories, select high-value documents, exfiltrate th

4. update from malware.news

   Server Mistake Exposes StopAndProtect’s Hacked WordPress Network

   malware.news · 55d ago · August 19th, 2026

   Waqas reports: A server mistake by cybercriminals has exposed the inner workings of a global malware operation that used nearly 2,000 hacked WordPress websites to infect computers, steal files and deploy ransomware. Further investigation found a complete malware toolkit supported… Source Article Link: https://databreaches.net/2026/08/19/server-mistake-exposes-stopandprotects-hacked-wordpress-network/