The people behind a ransomware operation called StopAndProtect were so careless with their own servers that researchers could walk in and watch the crime happen. Check Point Research collected roughly 31,000 screenshots taken from infected computers between mid-May and the end of July 2026, pulled straight from directories the attackers had left open on the websites they had hacked.
The screenshots show victims' desktops, ransom messages on screen, file listings after encryption, open office documents, and in several cases browsers pointed at antivirus vendors' websites as people tried to work out what had just happened to them.
Two thousand hacked sites doing the dirty work
StopAndProtect does not rent servers. It runs on other people's WordPress sites. Check Point recovered text files from the operation listing close to 2,000 compromised WordPress domains, and those sites do everything: host the malware stages, pass commands to infected machines, and store the documents, screenshots and activity logs taken from victims. The internal logs record thousands of affected IP addresses, most of them in the United States, Russia and India.
Researcher Jaromir Horejsi, who published the original report, found the way in was neglect rather than anything clever. One compromised site he scanned was still running a WordPress release from 2021, almost five years old, and turned up nearly 40 separate weaknesses including SQL injection flaws, authentication bypasses, open redirects and file-upload holes.
The victim never sees the hacked site coming
Someone visiting a compromised site gets a fake CAPTCHA built on the ClickFix trick, which talks the user into pasting and running a PowerShell command to prove they are not a robot. That starts two PowerShell stages, then two .NET loaders, then a whole toolkit: a file encryptor, a worm that spreads over SMB and USB, a lock screen, a credential stealer, a script-based spreader, and, more unusually, a chat utility the criminals use to talk to their victims directly.
Encryption is not always the point. Check Point says the attackers often skip the ransomware entirely and quietly take file listings, and later specific files, off the machine instead. That is why the team applied the name StopAndProtect to the whole operation rather than just to the encryptor it was first given to.
Check your mu-plugins folder
Site owners have something specific to look for. The attackers install a WordPress plugin that writes a must-use plugin to wp-content/mu-plugins/wp-sec.php, then deactivates and deletes itself. Must-use plugins load on every request and never appear in the normal Plugins screen, so nothing looks wrong in the dashboard. The file adds a hidden REST endpoint at wp-sec/v1/upload, protected only by hardcoded credentials, that accepts uploads almost anywhere under the WordPress root and explicitly allows .php files, which hands remote code execution to anyone holding the password.
The remedy is unglamorous: update WordPress and every plugin, audit wp-content/mu-plugins by hand, and hunt for unfamiliar PHP file managers and uploaders. Hacked WordPress installations keep resurfacing as delivery infrastructure, most recently pushing an infostealer through the Deno runtime, and ClickFix remains the dependable way onto the endpoint, including against Mac users.
Indicators
Check Point published a full indicator set alongside its research. Sample payload hashes (SHA-256): cab7f141fd6f2c58055b3731ef6a64b8a2d4d88a974770b047da19c0904322f0, cc8aa2bd7bf74ca0bbc5cb03a7b18eae73094b450d11654528c05685fe12e0c9 and 99bcb531d6dd3c93d3f28f03d6e4659c865a4ffbd2fb514e809017f3446a940b.
The most useful thing in this report is not a hash. It is the reminder that a crew running on stolen infrastructure is also running on somebody else's neglect, and that an unpatched WordPress site is very rarely just its owner's problem.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.