Hook
We do not build for today. Yet the StopAndProtect ransomware campaign—active since May 2025, still infecting IPs as of July 24—proves that the industry’s most fragile infrastructure is not the blockchain, but the human mind. Over 6,000 IPs compromised. Nearly 2,000 WordPress sites weaponized. 31,000+ screenshots exfiltrated. 700+ compressed archives stolen. And somewhere in that data: your recovery phrase, your private keys, your entire portfolio.
The attack chain is not novel in isolation. Fake captcha pages are a decade old. PowerShell droppers are standard. Ransomware that spreads via network shares and USB drives is textbook. What makes this campaign a technical landmark is the fusion: a supply-chain attack on the WordPress ecosystem, repurposed as a crypto wallet heist. The art is the hash; the value is the proof—but when the proof is stolen before it’s ever written to the chain, the hash becomes irrelevant.
Context
WordPress powers over 40% of the web. Its plugin ecosystem is vast, but its security patch cycle is notoriously slow. Attackers have long exploited this: compromised admin credentials, vulnerable plugins, outdated themes. The StopAndProtect operation simply scales this up. They infect a WordPress site—likely through a known vulnerability in a popular plugin like Elementor or Yoast—then inject a fake captcha script. The script displays a seemingly legitimate “I am not a robot” challenge. But the challenge is a trap.
When a user completes the captcha, the page prompts them to copy a “verification code” and paste it into Windows PowerShell (Run as Administrator). The code is a multi-stage payload: it downloads a ransomware binary, establishes persistence, attempts lateral movement, and—most critically—scans for cryptocurrency wallet files and recovery phrases. The malware then exfiltrates this data to the compromised WordPress site’s own server, which acts as a command-and-control (C2) relay. The C2 infrastructure is decentralized across the infected sites, making takedown difficult.
Check Point Research (CPR) uncovered the operation after analyzing one of the fake captcha pages. They traced the attack back to 1,976 unique WordPress domains, all serving the same malicious script. The ransomware itself—StopAndProtect (a variant of the STOP/Djvu family)—encrypts files with a .stopandprotect extension, then demands a ransom in cryptocurrency. But the wallet theft is the real prize. The encryptor is a distraction.
Core: Code-Level Analysis and Trade-offs
Let’s dissect the PowerShell command. During my audits of security-critical smart contracts, I learned to treat every line of code as a potential reentrancy vector. The same principle applies here. The malicious payload is obfuscated, but CPR’s reverse engineering reveals the core logic:
$code = "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('BASE64_ENCODED_SCRIPT'))"
Invoke-Expression $codeThe base64-decoded script performs: 1. Download and execute a ransomware binary from a remote URL (hosted on another compromised WordPress site). 2. Enumerate local drives, network shares, and connected USB devices. 3. Search for files matching patterns: 0 .dat, 1 , 2 , 3 , 4 . 4. Upload matching files to the C2 server via HTTP POST. 5. Take screenshots of the user’s desktop every 30 seconds and upload them. 6. Extract browser-stored passwords and cookies. 7. Encrypt user files with AES-256, appending .stopandprotect. 8. Display a ransom note.
The trade-off here is between automation and stealth. The script is aggressive—it scans and uploads everything it can. But it’s also noisy. A well-configured endpoint detection and response (EDR) system would flag the mass file upload and the PowerShell base64 decode. The attackers assume that the average user does not have EDR, and they are correct.
What I find most interesting is the use of the compromised WordPress site as both the delivery vector and the data exfiltration endpoint. This is a dual-use of the same infrastructure. The infected WordPress site serves the captcha, receives the stolen data, and also hosts the ransomware binary. This means the attacker can rotate C2 domains simply by infecting new sites. The cost of infrastructure is the cost of exploiting a WordPress vulnerability—close to zero.
But there is a critical flaw: the attacker’s own C2 can be used against them. CPR researchers discovered that the C2 server was also accepting uploads from the attacker’s own internal tests. They found 31,000+ screenshots, many of which appeared to be from the attacker’s own machines—including desktop wallpapers, open browser tabs, and even what appeared to be a screenshot of the attacker’s own wallet management software. This is a classic case of operational security failure. The attacker forgot to isolate their own testing environment from the live C2.
Reentrancy doesn't care about your marketing. The same principle applies to cybercriminal operations: if you use the same infrastructure for development and production, you will eventually leak your own data. CPR now has a trove of evidence that could lead to identification of the threat actor.
Contrarian: The Real Blind Spot Is Not the Code—It’s the User’s Mental Model
Everyone is focused on the technical sophistication of the attack. The fake captcha, the PowerShell dropper, the ransomware encryption. But the real vulnerability is not the WordPress plugin or the execution of arbitrary code. It is the user’s mental model of “security.” The user believes that a captcha is a security mechanism. They trust the website because it looks legitimate. They copy-paste a command because they are told it is a “verification code.”
This is a social engineering attack that exploits the user’s understanding of security protocols. The captcha is a ritual that signals “I am human.” The PowerShell command is a ritual that signals “I am authorized.” By combining these rituals with a malware payload, the attacker bypasses the user’s rational defenses.
From a technical perspective, the attack is trivially preventable. The user should never execute commands from a web page. The user should never input their recovery phrase into any software. The user should use a hardware wallet. But the industry has failed to educate users on these fundamentals. Instead, we build more complex DeFi protocols and more abstracted UX, assuming that security will be handled by the infrastructure.
This is a blind spot that applies to the entire Web3 ecosystem. We audit smart contracts, we stress-test consensus mechanisms, we design zero-knowledge proofs. But we ignore the human layer. The StopAndProtect campaign is a reminder that the weakest link is not the protocol—it is the user’s willingness to trust a captcha.
We do not build for today. We build for a future where users are trained to never trust, always verify. But that future is not here. Today, the captcha wins.
Takeaway: The Next Wave of Attacks Will Clone This Playbook
This campaign is not a one-off. It is a proof-of-concept for a new class of attack: the WordPress-to-Wallet attack chain. The infrastructure is cheap (compromised sites), the payload is customizable (any ransomware or stealer), and the targeting is precise (crypto users). Expect to see clones targeting other CMS platforms (Joomla, Drupal), other OS (macOS with fake terminal commands), and other sensitive data (exchange API keys, hardware wallet seeds).
The industry must respond with two layers of defense: 1. Technical: EDR rules that block PowerShell execution from web context. Browser extensions that detect captcha-based social engineering. WordPress security plugins that monitor for injected scripts. 2. Educational: Every wallet provider, every exchange, every DeFi protocol must hammer the message: “Never type your recovery phrase. Never run a command from a website. Use a hardware wallet.”
We do not build for today. But the attackers are building for tomorrow. The question is: will we deploy the patches before the next wave hits?
--- This article is based on findings from Check Point Research. The analysis reflects my own security audit experience and forensic dissection of the attack chain.