StopAndProtect Turns 2,000 Hacked WordPress Sites Into a Criminal Malware Delivery Network
What Happened — Check Point Research uncovered a campaign, dubbed StopAndProtect, that has commandeered nearly 2,000 compromised WordPress sites. The attackers use these sites as a shared platform to host malware stages, deliver ransomware, steal documents, and run surveillance tools. The infection chain begins with a fake CAPTCHA that forces visitors to execute a malicious PowerShell command.
Why It Matters for Compliance & Audit Readiness
- The scenario illustrates a classic control‑gap: unpatched CMS software becomes an attack vector that can compromise not only the site owner but also downstream users.
- SOC 2‑aligned continuous‑compliance programs must map such misconfiguration risks to the CC6.1 – System Operations and CC7.1 – Change Management criteria, and collect ongoing evidence that patches and configuration baselines are enforced.
- Verisq’s Control Mapping capability can automatically correlate WordPress version/plug‑in inventories with required controls, generating audit‑ready evidence of remediation.
Who Is Affected
- Small‑ and medium‑size businesses that run self‑hosted WordPress sites.
- Managed hosting providers and SaaS platforms that offer WordPress‑based web services.
- Any organization whose customers or employees browse compromised sites (e.g., media, e‑commerce, education).
Recommended Actions
- Inventory all public‑facing WordPress installations and verify version/plug‑in status.
- Apply security patches immediately; retire sites that cannot be patched.
- Enable Web Application Firewall (WAF) rules that block known malicious CAPTCHA patterns.
- Map the remediation steps to SOC 2 CC6.1 and CC7.1 controls and capture evidence in a continuous‑compliance repository.
Technical Notes – The attackers exploit outdated WordPress cores (e.g., 2021 releases) and vulnerable plugins with known SQL‑injection, auth‑bypass, and arbitrary file‑upload flaws. The fake CAPTCHA (ClickFix technique) delivers a PowerShell payload that chains through multiple downloaders before deploying ransomware, data‑theft modules, and a chat channel for victim interaction. Source: SecurityAffairs