Nearly 2,000 compromised WordPress websites have been repurposed as criminal infrastructure to distribute malware, steal data, monitor victims, and deploy ransomware, according to cybersecurity firm Check Point Research, which detailed the findings in a report published on Tuesday.

Researchers first identified the StopAndProtect ransomware family in mid-May before tracing it back to a much broader operation. The hijacked websites served multiple functions: they hosted malware payloads, relayed commands to infected computers, and stored stolen documents, screenshots, and activity logs. Compromised legitimate sites are prized as criminal infrastructure precisely because they look trustworthy — connections to an established domain are less likely to be blocked than traffic to a known malicious server — and WordPress's enormous footprint makes it a recurring backdrop for such abuse, as the platform powers more than 40 percent of all websites, according to W3Techs' ongoing web-technology surveys.

"The operation doesn't rely on a single piece of malware, but on a whole toolkit of criminal software working together," Check Point researcher Jaromír Horejsi wrote. "Some components encrypt files, others silently steal documents or lock the screen, and another acts as a live chat between the attackers and their victims."

According to Check Point, the malware targets Windows users and begins with a fake CAPTCHA displayed on a compromised website. The ClickFix prompt instructs victims to run a PowerShell command that installs malware capable of stealing credentials and cryptocurrency wallet seed phrases, spreading through networks and USB drives, locking screens, and deploying ransomware. The report did not say whether macOS and Linux users are affected.

The chain leans on tools victims already have. Because users paste and execute the PowerShell command themselves, the attack can slip past browser protections that would intercept a conventional drive-by download — and PowerShell, a Windows administration utility installed by default on the operating system, has long been one of the most frequently abused tools in real-world intrusions.

The attackers' own mistakes, however, gave Check Point researchers an unusually deep look inside the operation, the company said.

"Operational security (OPSEC) failures by the developer exposed lots of files, including detailed infection logs from victims' machines, screenshots from infected computers, and source code of tools the criminals use to mass-manage compromised websites," Horejsi wrote.

By July 24, the campaign had compromised more than 6,000 unique IP addresses, including 1,852 in the United States and 630 each in Russia and India. Exposed directories contained infection logs and screenshots taken from victims' computers. Between mid-May and the end of July, researchers said they collected more than 31,000 screenshots, along with over 700 archives of stolen data that included documents, passwords, and cryptocurrency wallet files.

Check Point believes the threat actor also accidentally infected itself with its own malware.

"We collected a few hundred files exfiltrated from victims' machines, and we believe that in one instance the threat actor infected themselves, as one archive contained several unusual files with suspicious content," Horejsi wrote. "This also helps us better understand how the actor operates and how many compromised domains they likely control."

ClickFix scams have surfaced in several other malware campaigns this year. In May, an apparel website linked to FBI Director Kash Patel was taken offline after macOS visitors were reportedly targeted with ClickFix malware. Users were prompted to paste a command into Terminal that installed an infostealer capable of targeting browser data, session tokens, and crypto wallets.

In July, Jamf Threat Labs found ClickFix-style malware being distributed through a sponsored ad on X. The ad redirected users to a website that instructed them to open Terminal and run a command installing a variant of the Atomic infostealer.

In August, Microsoft researchers warned that hackers were using compromised websites and BNB Chain smart contracts to distribute malware through fake CAPTCHAs.

Across all of these campaigns, the practical defense is the same and requires no technical skill: a genuine CAPTCHA verification never asks users to open a terminal or run a command. Check Point's findings also point to the other side of the problem — for the owners of the millions of sites built on WordPress, a hijacked page is not merely a breach of their own property, but a piece of infrastructure turned against their visitors and the wider internet.