Since May 2026, StopAndProtect has quietly compromised thousands of vulnerable WordPress sites in a sophisticated, multilayered campaign uncovered by CheckPoint. The initial vector is social engineering via CAPTCHA prompts, followed by a series of user-induced downloads, and finally, loader and payload execution. It is suspected that an OPSEC failure may have caused the threat actor to infect their own machine and upload desktop files to the C2 server, giving CheckPoint researchers rare insight into the operation.
CAPTCHA ClickFix as initial vector
Since the TA571 / DarkGate campaign in 2024, one of the earliest documented usages of this technique, ClickFix campaigns have garnered widespread popularity among threat actors. The technique is simple yet destructive; the user is lured into copying a malicious command and following a few steps that result in the user running the command and infecting themselves. The StopAndProtect campaign follows the same playbook. WordPress users are socially engineered to copy to clipboard and run a Powershell command as part of a routine seemingly similar to “I’m not a robot” authentication. From there, the path to full system compromise is remarkably short. In this operation, the attackers hosted the entire operation on hacked vulnerable WordPress sites that served as the perfect infrastructure for the campaign.
YARA Rule: Hunting for SilentEncryptor
SilentEncryptor is the ransomware component of the StopAndProtect campaign. It downloads a command file from the C2 server with instructions that determine which infected endpoints are to be encrypted. The ransom messages are retrieved dynamically from the C2 server as well, therefore the attacker can change the message between infections rather than relying on a single message embedded in the malware.
The YARA rule we composed is a high fidelity hunting rule which focuses on elements observed in the 3 ransomware samples from the original report, but is broad enough to capture other samples employing similar tactics. See IOC section for a list of indicators.
The Integration Pattern
import "pe"
rule SilentEncryptor_Ransomware_HiFi {
meta:
author = "Evelyne Diaz Araque ([email protected])"
date = "2026-08-26"
description = "Hunts for the SilentEncryptor ransomware from the StopAndProtect campaign and variants exhibiting similar tactics."
ref = "https://research.checkpoint.com/2026/thousands-of-hacked-wordpress-sites-one-operation-unmasking-stopandprotect/"
hash1 = "65550f6d0ffec8421f703cdc7273d9c0563b3d480fe6702bad294a18afe72143"
hash2 = "b79b9b027f76579555069a7506d946648a8cb3126c0dda837dc9fee0e5c79489"
hash3 = "0080d0dd72eda4850a02e51c0e5c6f768423dfe970cafae2ab52ceee75972b40"
strings:
// embedded marker string unique to these samples
$s1 = "*V*RrETTY" ascii
// format strings seen in some of the variants
$s2 = "{0}/wallet_{1}.dat" wide
$s3 = "{0}/{1}_wallet_{2}.dat" wide
$s4 = "AddDocumentToZip: SKIP (size >10MB): " wide // debug/logging strings used
// base64-encoded hardcoded wallets
$w1 = "QzpcVXNlcnNce3VzZXJuYW1lfVxBcHBEYXRhXFJvYW1pbmdcTXlFdGhlcldhbGxldFx1dHYtZGF0YQ==" wide // MyEtherWallet
$w2 = "QzpcVXNlcnNce3VzZXJuYW1lfVxBcHBEYXRhXFJvYW1pbmdcRGFzaFx3YWxsZXQuZGF0" wide // Dash
$w3 = "QzpcVXNlcnNce3VzZXJuYW1lfVxBcHBEYXRhXFJvYW1pbmdcRXhvZHVzXGV4b2R1cy5jb25maWc=" wide // Exodus
$w4 = "QzpcVXNlcnNce3VzZXJuYW1lfVxBcHBEYXRhXFJvYW1pbmdcRG9nZWNvaW5cd2FsbGV0cw==" wide // Dogecoin
$w5 = "QzpcVXNlcnNce3VzZXJuYW1lfVxBcHBEYXRhXFJvYW1pbmdcRW5qaW4=" wide // Enjin
$w6 = "QzpcVXNlcnNce3VzZXJuYW1lfVxBcHBEYXRhXFJvYW1pbmdcS3Jha2Vu" wide // Kraken
$w7 = "QzpcVXNlcnNce3VzZXJuYW1lfVxBcHBEYXRhXFJvYW1pbmdcRGFzaFx3YWxsZXRz" wide // Dash\wallets
$w8 = "QzpcVXNlcnNce3VzZXJuYW1lfVxBcHBEYXRhXFJvYW1pbmdcRU9TXHdhbGxldC5kYXQ=" wide // EOS\wallet.dat
$w9 = "QzpcVXNlcnNce3VzZXJuYW1lfVxBcHBEYXRhXFJvYW1pbmdcQ2FyZGFub1x3YWxsZXQuZGF0" wide // Cardano
$w10 = "QzpcVXNlcnNce3VzZXJuYW1lfVxBcHBEYXRhXFJvYW1pbmdcVHJvblx3YWxsZXQuZGF0" wide // Tron
$w11 = "QzpcVXNlcnNce3VzZXJuYW1lfVxBcHBEYXRhXFJvYW1pbmdcUmlwcGxlXHdhbGxldC5kYXQ=" wide // Ripple
$w12 = "QzpcVXNlcnNce3VzZXJuYW1lfVxBcHBEYXRhXFJvYW1pbmdcRXRoZXJldW1ca2V5c3RvcmU=" wide // Ethereum keystore
$w13 = "QzpcVXNlcnNce3VzZXJuYW1lfVxBcHBEYXRhXFJvYW1pbmdcQml0Y29pblNWXHdhbGxldC5kYXQ=" wide // BitcoinSV
$w14 = "QzpcVXNlcnNce3VzZXJuYW1lfVxBcHBEYXRhXFJvYW1pbmdcUGl2WFx3YWxsZXQuZGF0" wide // PivX
$w15 = "QzpcVXNlcnNce3VzZXJuYW1lfVxBcHBEYXRhXFJvYW1pbmdcU3RlbGxhclx3YWxsZXQuZGF0" wide // Stellar
$w16 = "QzpcVXNlcnNce3VzZXJuYW1lfVxBcHBEYXRhXFJvYW1pbmdcQml0Y29pblx3YWxsZXRz" wide // Bitcoin
// rich-text bold markup tokens used by the SilentEncryptor ransomware's lock-screen/ransom note
$t1 = "\\[/?bold\\]" wide
$t2 = "\\[bold\\](.*?)\\[/bold\\]" wide
condition:
(filesize <= 84480 and (any of ($s*)) and (4 of ($w*))) or
(pe.is_pe and (any of ($s*)) and (4 of ($w*)) and (1 of ($t*)))
}
IOCs
a5b512c09a6b0add18397238d0c64ff34b6d95f4114efe808df03e3e11c29fb1 01157318eb22dca42074696d65428c249a2c0e99b94d58baa5b82e2618224544 33f0886cdd31bfb3f084897cc5d3ce0b1b36870123e6ecbdf6ba4a864ab91ad7 5ab5ee10e37fc5265506b9091404ca059ea3d9abff3baf9e60210cf0fb180485 8756b07fd17813b96faa1be57df230f4cbd8e8657a8de6cde86a7a6c7324075a aec1c0f1e46141e9d83d23ccc1f0d780b2458856e83e8c302730a37949186fb3 74e51a0fa1bddf210f2586f7f45273ac1c8d4ff228d0ca16ac4e4699fcfc59f3 497393b7eb5f14a5696ee25942ff4c9f19e12411fa6c41b3ab50c2ea59fffc82 3180f31f37e357c47495133d728d10014027ef23289cf51e4b7ab2905e44bc9d efb6ea1070fbb1f8017aaa809992b6f3102972da39e0efcae538da8a63b32352 be4b81abae18baabc86a61db341861a6aadd427e456818fad13040d0fa2d3a9b 77b5f0020a1ddf7295584a8a2f343503bbbdc95c33c4a3579f920155be2b67b2 2d7b880343be620dd7dd542e861b2cddc331565ddd120a324a2f42c39aed8f74 bf208f5f04aa61ac6b2a399558805d99a72e051212f9faaef6a99b83222e95b4 9f642ea7a0cb9aa767912358dc44573e64474e400e4fe960bd2da917f00bdabe 103bf3f0ba2808852bbf660aeac0c5fa99e8bfbf2ae91317f235c7d3f78dbea7 edeac70ed6e774df3d21bca22701add30827b92098cf38ab66b605492666c46f 26a25a149b010af7d74ff30294da79c66eebb16284ac14e7f91f6bc7a28df018 e304b1e5212488274db882e47432292ab496e6635be76b577d8ca19feb8fdaab 5920466333551453eb2020d9c15e1f8dd741b70e5fd863124300d3f015193fe8 a3a3a9149c01507b7a8b1a9bd831f3db1fd8872d63f1c6cd1b1b999137ce03d9 fe17639c10356e9f2386a09e4a2d18532d29e808cedc1463d3bb5a947751f5fb
Key Takeaways
- ClickFix is an overly simple but effective technique; users who don’t exercise caution will be victims of such attacks.
- Vulnerable sites can provide attackers with the perfect infrastructure for a scalable campaign.
- YARA hunting can help your organization expand visibility beyond a single file.
- The variant list highlights the value of behavior and characteristics-based hunting efforts over IOC-only detection.
Put This Research to Work
Stairwell helps security teams find threats that never generated an alert. By preserving and continuously analyzing files from across your environment, Stairwell enables analysts to apply new intelligence retroactively, uncover related variants, and trace findings to affected assets.
Use the YARA rule above in Stairwell to determine whether StopAndProtect has ever touched your environment.
Learn more at stairwell.com and book a demo today.