StopAndProtect Uses Nearly 2,000 Hijacked WordPress Websites to Spread Malware

The cybercrime campaign tracked as StopAndProtect uses nearly 2,000 compromised WordPress websites to distribute malware, control infected hosts, and store stolen documents, screenshots, and activity logs. The infection chain starts with a fake ClickFix CAPTCHA-based social-engineering prompt that leads to the execution of a PowerShell command. The campaign may encrypt files, lock screens, spread through SMB/USB, and steal documents, credentials, WhatsApp data, and screenshots.