Hackers Hijack Thousands of WordPress Sites to Use as C2 Servers for StopAndProtect Malware

Cybersecuritynews •Guru Baran • August 18, 2026

A newly uncovered malware operation dubbed StopAndProtect is transforming thousands of hacked WordPress websites into a sprawling criminal command-and-control (C2) infrastructure. The campaign blends double-extortion ransomware with covert data theft, quietly harvesting sensitive corporate documents, system screenshots, user credentials, and active communication logs from compromised machines worldwide. Internal logs exposed through the threat actors’ operational […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

StopAndProtect Malware Campaign Exploits 2,000 Hacked WordPress Sites The StopAndProtect malware operation has compromised nearly 2,000 WordPress websites, turning them into command-and-control servers for ransomware and data theft. This campaign, identified by Check Point Research, blends ransomware with covert data harvesting, affecting organizations globally. The malware toolkit includes various criminal tools, with the operation first detected in May 2026. A recent server misconfiguration by the attackers exposed the inner workings of this extensive network. Victims are at risk of losing sensitive corporate documents, user credentials, and communication logs. Security experts emphasize the urgency of addressing this threat as it continues to evolve. 16 sources 68

Extracted Entities

Hackers Hijack Thousands of WordPress Sites to Use as C2 Servers for StopAndProtect Malware

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (3)

Platforms (1)