Nearly 2,000 Hacked WordPress Sites Used in Sophisticated Malware Operation
Cybersecurity firm Check Point Research has uncovered a widespread operation utilizing nearly 2,000 compromised WordPress websites to distribute malware, steal sensitive data, monitor victims, and deploy ransomware. The campaign, which began in mid-May, has been linked to the StopAndProtect ransomware family and involves a comprehensive suite of malicious tools working in concert.
A Multifaceted Criminal Toolkit
The compromised websites served as a central hub for the operation, hosting various malware components, issuing commands to infected computers, and storing stolen information such as documents, screenshots, and activity logs. “The operation doesn’t rely on a single piece of malware, but on a whole toolkit of criminal software working together,” explained Check Point researcher Jaromír Horejsi. He elaborated that some components are designed to encrypt files, while others silently exfiltrate documents or lock screens, and a distinct tool facilitates live communication between attackers and their targets.
Deceptive CAPTCHA Leads to Infection
The malware primarily targets Windows users, initiating its attack through a deceptive CAPTCHA prompt on a compromised website. This “ClickFix” prompt then directs victims to execute a PowerShell command. Upon execution, this command installs malware capable of stealing credentials, cryptocurrency wallet seed phrases, spreading across networks and USB drives, locking screens, and ultimately deploying ransomware. The report did not specify whether macOS or Linux users are affected.
Operational Security Lapses Expose the Operation
Despite the sophistication of the attack, errors made by the perpetrators inadvertently provided Check Point researchers with a detailed look into the operation. “Operational security (OPSEC) failures by the developer exposed lots of files, including detailed infection logs from victims’ machines, screenshots from infected computers, and source code of tools the criminals use to mass-manage compromised websites,” Horejsi noted.
By July 24, the campaign had affected over 6,000 unique IP addresses globally, with significant concentrations in the United States (1,852), Russia (630), and India (630). The exposed directories yielded over 31,000 screenshots collected between mid-May and the end of July, alongside more than 700 archives containing stolen data, including documents, passwords, and cryptocurrency wallet files.
Accidental Self-Infection and Broader Campaign Links
Check Point also believes the threat actor may have accidentally infected themselves. “We collected a few hundred files exfiltrated from victims’ machines, and we believe that in one instance the threat actor infected themselves, as one archive contained several unusual files with suspicious content,” Horejsi stated. This accidental exposure, he added, aids in understanding the actor’s methods and the scale of their compromised domain control.
The ClickFix mechanism has appeared in several other malware campaigns this year. In May, an apparel website associated with FBI Director Kash Patel was taken offline after macOS users were reportedly targeted with ClickFix malware, which prompted them to run a command in Terminal to install an infostealer. In July, Jamf Threat Labs identified ClickFix-style malware distributed via a sponsored ad on X, leading users to a site that instructed them to execute a command installing a variant of the Atomic infostealer. Earlier in August, Microsoft researchers had warned of hackers using compromised websites and BNB Chain smart contracts to distribute malware through fake CAPTCHAs.
