Cybercrime Operation StopAndProtect Targets Crypto Holders via Compromised WordPress Sites

A cybercrime campaign named StopAndProtect has exploited nearly 2,000 hacked WordPress websites to distribute malware and steal cryptocurrency wallet files. Check Point Research revealed the operation, which began in mid-May 2026, has affected victims across the United States, Russia, and India, with over 6,000 unique IP addresses identified as targets.

The attack utilizes a social-engineering technique called ClickFix, tricking users into executing malicious PowerShell commands under the guise of CAPTCHA verification. This initiates a multi-stage infection process, downloading various malware components designed to steal credentials and crypto wallet files. Many of the compromised sites were running outdated WordPress versions, some dating back to 2021, which highlights the importance of regular software updates for site administrators.

The operation's hybrid approach combines ransomware tactics with extensive data theft, encrypting files while simultaneously exfiltrating sensitive information. The malware specifically targets cryptocurrency wallet files, posing a significant risk to digital asset holders. Check Point researchers accessed over 31,000 screenshots and directories containing stolen data, providing insight into the attackers' methods and the scale of the operation.

As the campaign continues to evolve, the cleanup process is expected to be lengthy due to the widespread nature of the compromised sites and the infrastructure spread across various jurisdictions. The findings underscore the need for improved security practices among WordPress site administrators to mitigate such threats.

© 2026 KLEA News. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Source: KLEA News