{"id":242916,"date":"2026-08-20T05:17:03","date_gmt":"2026-08-20T10:17:03","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/08\/stopandprotect-uses-nearly-2000-hacked-wordpress-sites-to-spread-malware-and-steal-data"},"modified":"2026-08-20T05:17:03","modified_gmt":"2026-08-20T10:17:03","slug":"stopandprotect-uses-nearly-2000-hacked-wordpress-sites-to-spread-malware-and-steal-data","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/08\/stopandprotect-uses-nearly-2000-hacked-wordpress-sites-to-spread-malware-and-steal-data","title":{"rendered":"StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/stopandprotect-uses-nearly-2000-hacked-wordpress-sites-to-spread-malware-and-steal-data.jpg\"><\/a><\/p>\n<p>Cybersecurity researchers have flagged a global cybercrime operation that abuses thousands of hacked WordPress websites as infrastructure to disseminate malware, commandeer infected hosts, store stolen documents, screenshots, and activity logs created to track the status of the activity.<\/p>\n<p>\u201cThe operation doesn\u2019t rely on a single piece of malware, but on a whole toolkit of criminal software working together \u2013 some components encrypt files, others silently steal documents or lock the screen, and another acts as a live chat between the attackers and their victims,\u201d Check Point Research\u2019s Jarom\u00edr Ho\u0159ej\u0161\u00ed <a href=\"https:\/\/research.checkpoint.com\/2026\/thousands-of-hacked-wordpress-sites-one-operation-unmasking-stopandprotect\/\" target=\"_blank\">said<\/a>.<\/p>\n<p>The large-scale campaign is being tracked by the cybersecurity company under the moniker <strong>StopAndProtect<\/strong> after discovering a ransomware family of the same name in mid-May 2026. The infection chain begins with a <a href=\"https:\/\/thehackernews.com\/2026\/08\/clickfix-attacks-deliver-macos-stealer.html\" target=\"_blank\">ClickFix<\/a> social engineering attack, resulting in the execution of a PowerShell command that leads to the deployment of additional. NET downloaders and loaders.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Cybersecurity researchers have flagged a global cybercrime operation that abuses thousands of hacked WordPress websites as infrastructure to disseminate malware, commandeer infected hosts, store stolen documents, screenshots, and activity logs created to track the status of the activity. \u201cThe operation doesn\u2019t rely on a single piece of malware, but on a whole toolkit of criminal [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34,1625],"tags":[],"class_list":["post-242916","post","type-post","status-publish","format-standard","hentry","category-cybercrime-malcode","category-encryption"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/242916","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=242916"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/242916\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=242916"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=242916"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=242916"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}