An operational security failure has given researchers an unusually detailed view inside a large-scale cybercrime operation. The newly uncovered StopAndProtect campaign combines compromised WordPress websites, ClickFix social engineering, data theft and ransomware in a distributed infrastructure designed to hide malicious activity within legitimate web traffic.

Cybersecurity investigations usually begin at the victim’s end of an attack: an infected endpoint, an encrypted server, a suspicious network connection or stolen credentials. Far less frequently do researchers obtain an unobstructed view of the infrastructure and working methods behind an operation.

That is precisely what happened during Check Point Research’s investigation of StopAndProtect, a newly identified cybercriminal operation that first attracted the researchers’ attention in May 2026. A series of operational security, or OPSEC, failures exposed directories containing malware logs, screenshots taken from infected machines, exfiltrated documents and internal tools used by the operators themselves. Researchers were even able to recover source code belonging to software developed to manage compromised websites at scale.

The result is an unusually revealing case study of contemporary cybercrime. StopAndProtect is not simply another ransomware family. It is a modular criminal ecosystem capable of stealing information, spreading through networks and removable media, monitoring victims and, selectively, encrypting files.

The campaign also demonstrates how two developments in the threat landscape increasingly reinforce one another: the abuse of legitimate internet infrastructure and the shift from technical exploitation towards convincing users to compromise their own machines.

A cybercriminal infrastructure hidden inside the legitimate web

One of the most significant aspects of StopAndProtect is its infrastructure.

Rather than relying exclusively on dedicated command-and-control servers that can potentially be identified, blocked or taken offline, the operators make extensive use of compromised WordPress websites. According to Check Point Research, hacked sites were used to host malware components, deliver subsequent stages of the infection chain, exchange commands with infected machines and store stolen data, including documents, screenshots and activity logs.

This approach has an obvious operational advantage. Traffic between a corporate endpoint and an established website can appear considerably less suspicious than communication with a newly registered or obviously malicious domain. The attackers are, in effect, borrowing the reputation and infrastructure of legitimate organisations.

The scale of the WordPress ecosystem makes it particularly attractive for this type of abuse. WordPress itself reported at the end of 2025 that the platform powered more than 43 per cent of websites worldwide and accounted for 60.5 per cent of the content-management-system market.

This does not make WordPress inherently insecure. It does, however, create an enormous population of installations administered with widely differing levels of security maturity. Outdated core installations, abandoned plugins, weak credentials and insufficient monitoring can transform otherwise unremarkable websites into useful infrastructure for attackers.

Check Point’s investigation illustrates the problem vividly. Researchers examined one of the compromised sites and found a WordPress installation dating from 2021. Their scan identified almost 40 security weaknesses, ranging from SQL injection and authentication bypass issues to arbitrary file-upload vulnerabilities.

The lesson extends well beyond WordPress. Public-facing systems that organisations regard primarily as marketing or content platforms can become part of the wider attack surface. Once compromised, they may not merely expose the organisation operating them; they can be weaponised against thousands of unrelated users.

The attackers left the door open

Ironically, the operators themselves appear to have made precisely the kind of security mistakes they exploited elsewhere.

During the analysis, researchers discovered a PHP endpoint that exposed directory listings. Instead of revealing only individual malware samples, it opened a path into additional directories containing logs and operational material. Among the exposed data were records from infected machines, screenshots and files stolen from victims.

More revealing still was an archive containing what appeared to be internal development material.

Check Point Research believes that one of the people behind the operation may accidentally have infected their own development computer, causing files from the machine to be uploaded to the same collection infrastructure used for victim data. The archive contained source code for an automation tool designed to mass-manage compromised WordPress installations and several lists referring to close to 2,000 domains associated with the operation.

The recovered tooling provides an important indication of the industrialisation of the campaign. The operators were not apparently administering compromised websites individually. Researchers identified a custom Visual Basic 6 application capable of performing tasks across large numbers of sites, including activating and deactivating the fake CAPTCHA mechanism, uploading files and modifying the infrastructure used to redirect malicious traffic.

In other words, the compromised websites formed a manageable distributed platform rather than a loose collection of hacked servers.

That distinction matters. Modern cybercrime increasingly depends not only on sophisticated malware but on operational efficiency: automation, scalable infrastructure, telemetry and centralised control. StopAndProtect contains all of these characteristics.

Thousands of systems appear in the campaign logs

The exposed logging infrastructure also gives researchers an unusual opportunity to estimate the scale of the operation.

Check Point’s public material describes a campaign affecting more than 5,000 infected computers. The underlying technical analysis provides a somewhat more nuanced picture: as of 24 July 2026, the researchers had identified more than 6,000 unique IP addresses in the collected logs. They explicitly caution that some records originated from security researchers and sandbox environments, although they assess the majority as belonging to genuine victim machines. The United States accounted for the largest identified group, followed by Russia and India.

These figures therefore should not be interpreted as an exact victim count. They nevertheless demonstrate that StopAndProtect is not a narrowly targeted or geographically isolated campaign.

The exposed infrastructure contained further evidence of substantial activity. Researchers collected more than 700 archives uploaded from infected systems between mid-May and the end of July. Another publicly accessible directory reportedly contained more than 20,000 activity screenshots, with hundreds of individual screenshot files recovered before the server was cleaned up.

ClickFix turns the user into the execution mechanism

For all the complexity visible behind the scenes, the initial compromise does not depend on a sophisticated zero-day vulnerability.

Instead, StopAndProtect relies on ClickFix, a social-engineering technique that has become increasingly prominent in malware campaigns.

Visitors to a compromised website are presented with what appears to be a normal human-verification or CAPTCHA process. The page then instructs them to perform additional actions on their computer. Behind the scenes, a malicious PowerShell command is placed on the clipboard. If the victim follows the instructions and executes it, the infection begins.

The technique is effective because it subverts a familiar security concept. Users have been trained for years to expect CAPTCHA checks, browser verification pages and other anti-bot challenges. Attackers reproduce the visual language of these legitimate mechanisms but add one crucial step: the user is asked to interact directly with the operating system.

The victim therefore becomes part of the execution chain.

That can undermine security assumptions based primarily on blocking malicious attachments or browser exploits. As Check Point notes in its broader analysis of ClickFix campaigns, manually launched commands can resemble legitimate user activity, while compromised established websites may retain valid certificates and good domain reputations.

StopAndProtect follows this pattern closely. The fake CAPTCHA initiates two PowerShell stages before .NET-based loaders retrieve the principal malware components. The resulting toolset includes an encryptor, a credential stealer, a lock-screen component, an SMB and USB worm, a VBS-based spreader and a utility allowing interaction between the attacker and victim system.

Ransomware is only one possible outcome

The breadth of these components is important because categorising StopAndProtect simply as ransomware would understate the threat.

Check Point originally assigned the StopAndProtect name to the ransomware component but subsequently applied it to the overall operation. Encryption is not triggered on every compromised system. In other cases, the malware quietly inventories files and allows operators to select particular information for exfiltration.

The data-collection component is particularly intrusive. According to the technical analysis, newer versions can log keystrokes, capture screenshots at 30-second intervals while a victim is active, enumerate local, removable and network drives and steal selected files. Researchers also observed functionality designed to extract WhatsApp contact information.

Other modules provide propagation capabilities. The NetworkShareScanner component searches network shares and USB devices, while another spreader can scan networks and use Windows Management Instrumentation for remote process creation.

This flexibility allows the operators to decide what a particular compromise is worth before choosing the next stage of the attack. A machine may become a source of credentials or documents, a foothold for lateral movement or a ransomware target.

For defenders, that makes early detection considerably more important. Waiting for file encryption as the definitive sign of compromise means responding only after several earlier stages have already succeeded.

Trust is becoming part of the attack surface

StopAndProtect also illustrates a broader challenge for enterprise security architectures.

Traditional indicators of trust are becoming increasingly unreliable when considered in isolation. A website may be legitimate but compromised. A TLS certificate may be valid while the content being delivered is malicious. A PowerShell process may have been initiated by the user but only because the user was manipulated into doing so.

The attack therefore crosses boundaries between web security, endpoint detection, identity protection and human behaviour.

Security awareness remains necessary, but training alone is not enough. Organisations should make one rule particularly clear: a legitimate CAPTCHA should not require users to open PowerShell, Windows Run, Terminal or another operating-system interface and paste commands into it. Any such request should be treated as a security incident rather than a verification procedure.

From a detection perspective, security operations teams should also examine behavioural combinations rather than relying solely on individual indicators: browser activity immediately followed by unexpected PowerShell execution, hidden PowerShell windows, script downloads from websites not normally associated with software distribution, in-memory .NET execution, unusual access to removable media or network shares, and unexplained outbound transfers of archives or screenshots all deserve scrutiny.

Website operators have a parallel responsibility. WordPress core, themes and plugins need disciplined vulnerability and patch management, while unused extensions should be removed rather than simply disabled. File-integrity monitoring, strong administrator authentication and monitoring for unexpected PHP files, plugins and changes to web content can reduce the time attackers remain undetected.

The strategic lesson from StopAndProtect

Perhaps the most interesting aspect of StopAndProtect is not an individual malware feature but the way the operation combines several established techniques into a scalable system.

The criminals exploit neglected web infrastructure to acquire trusted distribution points. They use social engineering rather than depending on endpoint vulnerabilities. They employ legitimate system tools such as PowerShell to initiate execution. Modular payloads allow them to adapt the consequences of each infection, while extensive telemetry gives operators visibility over compromised systems.

Yet the investigation also demonstrates the fragility of criminal operations.

The same need for automation, logging and centralised administration that allows a campaign to operate at scale creates information that can become extremely valuable to defenders when it is exposed. In this case, an improperly protected directory and the suspected self-infection of an operator appear to have transformed a conventional malware investigation into a detailed view of the adversary’s infrastructure.

For security teams, StopAndProtect is therefore both a warning and an opportunity. It shows how legitimate websites and familiar security interactions can be turned against users, but also how operational mistakes by adversaries can reveal relationships between malware, infrastructure and victims that would otherwise remain hidden.

The attackers behind StopAndProtect built their operation around the weaknesses of others. Ultimately, one of the most revealing weaknesses may have been their own.