Server Mistake Exposes StopAndProtect’s Hacked WordPress Network

Databreaches •Dissent • August 19, 2026

Waqas reports: A server mistake by cybercriminals has exposed the inner workings of a global malware operation that used nearly 2,000 hacked WordPress websites to infect computers, steal files and deploy ransomware. Check Point Research identified the operation as StopAndProtect after first encountering its ransomware component in May 2026. Further investigation found a complete malware toolkit supported... Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

StopAndProtect Malware Campaign Exploits 2,000 Hacked WordPress Sites The StopAndProtect malware operation has compromised nearly 2,000 WordPress websites, turning them into command-and-control servers for ransomware and data theft. This campaign, identified by Check Point Research, blends ransomware with covert data harvesting, affecting organizations globally. The malware toolkit includes various criminal tools, with the operation first detected in May 2026. A recent server misconfiguration by the attackers exposed the inner workings of this extensive network. Victims are at risk of losing sensitive corporate documents, user credentials, and communication logs. Security experts emphasize the urgency of addressing this threat as it continues to evolve. 16 sources 68

Extracted Entities

Server Mistake Exposes StopAndProtect’s Hacked WordPress Network

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)