tech π¨ 2000 hacked WordPress sites used for cyberattacks
A major cybercrime operation is using nearly 2,000 hacked WordPress sites as infrastructure to spread malware and steal data. The campaign was tracked by Check Point after discovering a ransomware family named StopAndProtect in mid-May 2026. This attack begins with a ClickFix social engineering assault, leading to the deployment of various criminal software components. Threat actors are covertly stealing file lists and specific documents from victims' systems. As of July 24, 2026, the operation has compromised over 6,000 unique IP addresses across the U.S., Russia, and India.