ClickFix ransomware operation weaponizes ~2,000 hacked WordPress sites
Check Point has dissected a ransomware family it calls StopAndProtect, first spotted in May 2026, that infects victims through fake-CAPTCHA ClickFix prompts. The full chain spans PowerShell, two rounds of .NET loaders, then ransomware, a USB worm, and a credential stealer. Crucially, operators host all of it on thousands of outdated WordPress sites, some running five-year-old versions with nearly 40 vulnerabilities. Their sloppy ops security let researchers read the logs and count roughly 2,000 compromised domains.