Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect

StopAndProtect is a large-scale criminal operation that uses compromised WordPress sites to deliver a multi-stage infection (ClickFix fake CAPTCHA → PowerShell → .NET loaders) which deploys a toolkit including ransomware (SilentEncryptor), a data stealer (SilentDataCollector), an SMB/USB worm, VBS spreader, lockscreen, and a custom chat utility; attacker OPSEC failures exposed extensive logs, screenshots, source code, and thousands of victim IPs (≈6,000+), enabling detailed analysis and a long list of IOCs.