StopAndProtect Campaign Exploits Nearly 2,000 Hacked WordPress Sites for Malware Distribution and Data Theft

A global cybercrime operation tracked as StopAndProtect has been flagged by cybersecurity researchers for abusing nearly 2,000 hacked WordPress websites as infrastructure. According to reporting, the compromised sites serve multiple purposes in the campaign: they are used to disseminate malware, store stolen documents and screenshots, and maintain activity logs created to track the status of the operation's activities. Researchers note that the operation does not rely on a single piece of malware but on a whole toolkit of criminal software. The infrastructure allows the threat actors to commandeer infected hosts and exfiltrate data gathered from victims. The exact number of affected sites and the full scope of the campaign's impact have not been independently verified. WordPress site administrators are advised to ensure their installations, plugins, and themes are up to date, remove unauthorized users and files, and audit for signs of compromise.