Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect

Check Point Research has identified a large-scale operation targeting thousands of WordPress sites using a ransomware family called StopAndProtect, which employs a ClickFix social-engineering technique to trick victims into executing malicious PowerShell commands. The attack chain involves multiple stages of downloaders, suggesting a sophisticated distribution infrastructure behind the campaign.