Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect
Check Point, Tuesday, August 18th, 2026
Check Point traces the StopAndProtect ransomware family to a ClickFix chain running through thousands of hacked WordPress sites.
Check Point Research published technical analysis of StopAndProtect, a ransomware family first observed in mid-May 2026.
Analysis of the infrastructure shows the infection chain starts with a ClickFix social-engineering technique that prompts victims to execute a PowerShell command.
That leads to two further stages of downloaders before the payload lands. The operation runs through thousands of compromised WordPress sites used to host the lures.
Researcher Jaromir Horejsi documents the infrastructure and the links tying the compromised sites into a single operation.