Hackers Turn Thousands of WordPress Sites Into StopAndProtect Malware Infrastructure

A newly uncovered cybercrime operation, dubbed StopAndProtect, has transformed thousands of compromised WordPress websites into a distributed infrastructure for malware delivery, command-and-control communications, and the storage of stolen data. Checkpoint first observed the campaign in mid-May 2026 and found that it blends ransomware activity with targeted data theft, enabling operators to decide whether to encrypt victims’ files, silently collect documents, or do both. The…

Diamond Model