Hackers Abuse Thousands of WordPress Sites to Spread StopAndProtect Malware via ClickFix

Gbhackers •Divya • August 19, 2026

A large-scale malware operation called StopAndProtect is exploiting thousands of compromised WordPress websites to distribute ransomware, steal files, harvest credentials, and remotely monitor victims through deceptive ClickFix CAPTCHA prompts. Researchers first identified the campaign in mid-May 2026. They discovered that the operation utilizes a broad range of criminal tools rather than relying on a single […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

StopAndProtect Malware Campaign Exploits 2,000 Hacked WordPress Sites The StopAndProtect malware operation has compromised nearly 2,000 WordPress websites, turning them into command-and-control servers for ransomware and data theft. This campaign, identified by Check Point Research, blends ransomware with covert data harvesting, affecting organizations globally. The malware toolkit includes various criminal tools, with the operation first detected in May 2026. A recent server misconfiguration by the attackers exposed the inner workings of this extensive network. Victims are at risk of losing sensitive corporate documents, user credentials, and communication logs. Security experts emphasize the urgency of addressing this threat as it continues to evolve. 16 sources 68

Extracted Entities

Hackers Abuse Thousands of WordPress Sites to Spread StopAndProtect Malware via ClickFix

The full story

Extracted Entities

Attack Types (2)

Malware (1)

Platforms (1)