Cybersecurity researchers have uncovered a sprawling malware operation that hijacked nearly 2,000 legitimate WordPress websites, transforming them into a distribution network for stealing cryptocurrency wallets, harvesting credentials, and deploying ransomware.
How the Attack Worked
The campaign, dubbed StopAndProtect, exploited vulnerabilities in WordPress installations to plant malicious code across compromised sites. Rather than defacing the pages, attackers kept the websites functioning normally so that visitors and site owners remained unaware their platforms had been weaponized.
Once a site was infected, it became part of a broader criminal framework used to serve malware to unsuspecting users. The approach allowed the operators to leverage the trust and traffic of established websites, dramatically expanding their reach without needing to build infrastructure from scratch.
Legitimate websites became silent accomplices, spreading malware while appearing completely normal to the people who visited them.
The malicious payloads were designed to accomplish several goals at once, from siphoning off sensitive data to locking down victims' machines with ransomware. That multipronged strategy made the operation particularly dangerous for anyone who stumbled onto a compromised page.
Crypto Wallets in the Crosshairs
A central target of the campaign was cryptocurrency holdings. The malware specifically hunted for wallet files stored on infected devices, giving attackers a direct path to drain digital assets from victims who kept funds in software wallets.
Crypto users are a frequent focus of these schemes because stolen wallet files or private keys can be used to move funds irreversibly, with little recourse for the victim. The blend of credential theft and wallet targeting reflects a growing trend of attackers chasing digital money alongside traditional data.
Beyond crypto theft, the operation also deployed ransomware, adding a layer of extortion to the damage. Victims could find themselves stripped of their assets and locked out of their systems in a single attack.
- Nearly 2,000 WordPress sites were compromised
- Malware targeted crypto wallet files for theft
- Credentials were harvested from infected users
- Ransomware was deployed to extort victims
Why It Matters
The scale of the StopAndProtect operation underscores the persistent risks tied to poorly secured content management systems. WordPress powers a huge share of the web, making it an attractive target for attackers seeking to