Threat Research · research.checkpoint.com

StopAndProtect Campaign Uses Thousands of Hacked WordPress Sites to Deliver Malware and Steal Data

Aug 18, 2026 · Original article ↗

Summary

Check Point researchers detail a campaign using compromised WordPress sites for ClickFix malware delivery, command and control, and stolen-data storage. The toolkit can encrypt files, steal data, spread across devices, and capture screenshots; logs showed more than 6,

Key points

Victims are lured by fake CAPTCHA ClickFix pages that prompt them to run a PowerShell command, starting a multi-stage .NET loader and malware infection chain.
Compromised WordPress sites host malware, relay commands, and store victim logs and stolen files; exposed directories and poor operational security revealed the infrastructure.
The toolkit includes ransomware, a file stealer, SMB/USB and VBS spreaders, a lock-screen component, a credential stealer, and a victim-operator chat utility.
The stealer can collect file listings and selected documents, capture screenshots, log keystrokes, and gather WhatsApp contact information.
Researchers collected more than 700 archives of stolen victim data and approximately 31,000 screenshots from mid-May through the end of July 2026.
Logs showed more than 6,000 unique IP addresses by July 24, 2026; the researchers caution that some records may come from sandboxes or researchers.
The researchers recovered attacker tools and lists referencing close to 2,000 compromised WordPress domains.

Article Details

Attack Vectors: A fake CAPTCHA ClickFix prompt on compromised WordPress websites tricks visitors into copying and executing a PowerShell command.
The PowerShell stages download and execute .NET loaders and additional malware components from compromised WordPress sites.
A malicious WordPress plugin adds a fake CAPTCHA and can direct visitors to the infection chain.
The malware spreads through network shares and USB devices; the VBS spreader also propagates to hard disks and removable media and uses WMI for lateral movement.
The operators use compromised WordPress sites to host malware, issue commands, and store logs and stolen data.
Defensive Notes: Keep WordPress and installed plugins updated; the article reports finding an old WordPress version with numerous vulnerabilities on one compromised site.
Check for unauthorized WordPress plugins, must-use plugins, PHP upload and file-management scripts, and unexpected files under wp-content/mu-plugins.
Check Point states that Threat Emulation and Harmony Endpoint provide coverage for the tactics, file types, and operating systems described.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`discherniation[.]com`	Compromised base C&C website.
DOMAIN	`ksr-racingparts[.]com`	Compromised website used by the operators as infrastructure.
DOMAIN	`maximumrock[.]ro`	Compromised website used by the operators as infrastructure.
DOMAIN	`mectcalcutta[.]com`	Compromised base C&C website.
DOMAIN	`norakremer[.]co[.]uk`	Compromised website used by the operators as infrastructure.
DOMAIN	`pharmart[.]ae`	Compromised website used by the operators as infrastructure.
DOMAIN	`platinumcar[.]ca`	Compromised website used by the operators as infrastructure.
DOMAIN	`v-k[.]com[.]ua`	Compromised base C&C website.
DOMAIN	`www[.]lapellelaser[.]pl`	Compromised base C&C website.
DOMAIN	`www[.]parsrulman[.]com`	Compromised base C&C website.
SHA256	`0080d0dd72eda4850a02e51c0e5c6f768423dfe970cafae2ab52ceee75972b40`	Hash listed for the stage 3 encryptor.
SHA256	`10babb15e08f9fbd72cce11713a273b971c910dd5bdb989a3f6ff4d9c8e372c0`	Hash listed for the stage 3 SMB/USB worm.
SHA256	`11a635d70444605ede1de0aa227a9fd7cfa4554e75bea93ce18b639ca571a42e`	Hash listed for the stage 3 lockscreen.
SHA256	`23cbabfe3ca3a7f1eb365f772d6a4ed8095cb8f7755622cc82e804478259dc70`	Hash listed for the stage 3 credential stealer.
SHA256	`2adbb2c206be7f23bf77f8f50d1ac0f809511c0b4591421931f81a6eaa42c68c`	Hash listed for the stage 3 lockscreen.
SHA256	`38602b76f6c65644b01fa4d81708251c159a883253cda8876396dc7212324ab9`	Hash listed for the stage 3 lockscreen.
SHA256	`3ba161ca7b8dcf389ec3236c9ddfb943e9d1766181b1b81a227649cad46132a8`	Hash listed for the stage 3 chat utility.
SHA256	`3ed8f2cc8da4853fd770ff38f0cbce6d9d4a84e75a828fc0cec3e3ec60db94f9`	Hash listed for the stage 3 chat utility.
SHA256	`4dee2fe98d4da75ffb259c03b50202212dafc85691429a28641a8068eddea504`	Hash listed under stage 1 downloader.
SHA256	`65550f6d0ffec8421f703cdc7273d9c0563b3d480fe6702bad294a18afe72143`	Hash listed for the stage 3 encryptor.
SHA256	`7d3604d0728b242c72bd144b8661ebf63c1042a4f5dd441bc8c8507c701df20c`	Hash listed under the stage 2 downloader and loader.
SHA256	`8337bf29100a5871b1275227006dc2a43b21b751e5ce7e2032364fd78af59ac5`	Hash listed under stage 1 downloader.
SHA256	`8d1e23630a6695fa9c793d73832f59436c98bba30ed81c16d01b549bd17feab4`	Hash listed for the stage 3 SMB/USB worm.
SHA256	`9765b1342cc7eb982a73bb1f94c6c500b63dc817073b76ea926c1097078d3527`	Hash identified for the stage 2 downloader and loader.
SHA256	`976cfa57e1efacbe517b7e3441e9473d275ec1d9ad8ab69ddf8ae3a966aaa153`	Hash listed under the stage 2 downloader and loader.
SHA256	`99bcb531d6dd3c93d3f28f03d6e4659c865a4ffbd2fb514e809017f3446a940b`	Hash identified for the stage 1 downloader.
SHA256	`b3dff910b350ace27d64cbd79405cb154a1967e366d7b88170c3e8303b1d08ad`	Hash listed for the stage 3 VBS spreader.
SHA256	`b79b9b027f76579555069a7506d946648a8cb3126c0dda837dc9fee0e5c79489`	Hash listed for the stage 3 encryptor.
SHA256	`cab7f141fd6f2c58055b3731ef6a64b8a2d4d88a974770b047da19c0904322f0`	Hash identified for PowerShell script stage 1.
SHA256	`cc8aa2bd7bf74ca0bbc5cb03a7b18eae73094b450d11654528c05685fe12e0c9`	Hash identified for PowerShell script stage 2.
SHA256	`f042240c3de00c46dee625916bf246b7e87481e4081a6a97208b091409766e41`	Hash listed for the stage 3 SMB/USB worm.