StopAndProtect Malware Campaign Exploits 2,000 Hacked WordPress Sites

• •Nearly 2,000 WordPress sites have been exploited for the StopAndProtect malware campaign.
• •The operation combines ransomware with covert data theft, targeting sensitive corporate information.
• •A server misconfiguration by attackers recently exposed details of this extensive malware network.

The StopAndProtect malware operation has compromised nearly 2,000 WordPress websites, turning them into command-and-control servers for ransomware and data theft. This campaign, identified by Check Point Research, blends ransomware with covert data harvesting, affecting organizations globally. The malware toolkit includes various criminal tools, with the operation first detected in May 2026. A recent server misconfiguration by the attackers exposed the inner workings of this extensive network. Victims are at risk of losing sensitive corporate documents, user credentials, and communication logs. Security experts emphasize the urgency of addressing this threat as it continues to evolve.