Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect
Analysis of a ransomware campaign targeting thousands of WordPress sites through ClickFix social engineering, revealing the complete infection chain from initial prompt to payload delivery and the infrastructure supporting the operation.
Why this matters
Analysis of a widespread ransomware campaign reveals an infection chain starting with ClickFix social engineering—a technique where victims are tricked into running a PowerShell command. The command triggers a multi-stage download sequence that ultimately delivers the ransomware payload. The research maps the infrastructure supporting the campaign and shows how thousands of WordPress sites were compromised through this vector. This matters because ClickFix and similar social-engineering entry points remain highly effective despite their simplicity, and the staged payload delivery pattern obscures the final malicious intent until late in execution. Defenders should recognize that site compromise via social engineering often precedes ransomware deployment, and should monitor for suspicious PowerShell invocations and unexpected download chains. Site operators should educate users about prompt-to-execute social engineering and maintain alerting on atypical command execution.
Check the original work
This explanation is Korpalis’s guide to the material, not a replacement for it. Read the publisher’s page for the full method, evidence and limitations.