A campaign researchers call ClickFix, or StopAndProtect, has run since at least December 2025. Attackers break into ordinary WordPress sites and use them to show visitors a fake "verify you are human" screen that talks them into infecting their own computer. Two research teams have documented it, months apart, and their numbers show how fast it grew.
The trick: the visitor does the work
On a compromised site, a visitor sees what looks like a Cloudflare or CAPTCHA overlay. Instead of ticking a box they are told to open the Windows Run dialog and paste a command. The command downloads and runs malware. Rapid7 Labs found the instructions localised into 31 or more languages, which points to an opportunistic campaign rather than one region or industry.
Two snapshots of one campaign
| Aspect | Rapid7 Labs | Check Point Research |
|---|---|---|
| Published | 10 March 2026 | Mid-August 2026 |
| Compromised WordPress sites | 250 or more, in at least 12 countries | Close to 2,000 domains |
| Victim machines | Not quantified | Over 6,000 unique IP addresses by 24 July 2026, mostly US, Russia, India |
| Payload | Three infostealers via a two-stage in-memory loader: a Vidar variant, a .NET "Impure Stealer", a new C++ "VodkaStealer" | The same, plus file-encrypting ransomware, an SMB and USB worm, a keylogger with screenshots every 30 seconds, a screen locker and a live chat window to the victim |
How the sites were broken into
Neither team found a single way in. Rapid7 noted that nearly every compromised site had a publicly reachable wp-admin login, and pointed to vulnerable plugins, outdated core versions, weak or reused administrator passwords and brute-forcing of that login as the likely routes. Check Point examined one site in detail: a WordPress install from 2021 exposed to roughly 40 known vulnerabilities, on which the attackers had planted a hidden must-use plugin opening REST endpoints for file upload and remote code execution. The attackers' own operational security failed too: Check Point found open directories with the group's infection logs, around 31,000 victim screenshots, and in one archive their source code and the full list of compromised domains.
What to check on your own sites
- wp-admin should not be reachable by anyone who has not authenticated: a firewall rule, an IP allowlist or basic authentication in front of the login page.
- Core, theme and every active plugin on the current version. An outdated component is the pattern both reports keep returning to.
- The administrator list: anything unfamiliar goes, and any administrator password that was ever reused elsewhere gets rotated.
- Any overlay on your site that was not added through the editor is a compromise, not a display bug. Investigate before removing it.
The pattern overlaps with what turned the BdThemes plugins into a rogue-administrator generator: the attacker needs a foothold in wp-admin, one way or another, before any of this works.
How to check whether one of your sites is already part of it
- Open the site in a private window, on a phone and on a desktop. The overlay is often shown only to visitors who arrive from a search engine or from a specific country, and not to a logged-in administrator. Follow a Google result to the site rather than typing the address.
- View the page source and search for scripts you did not add. Look for script tags that load from a domain you do not recognise, and for long strings of encoded text. Compare against a page on a site you know is clean, built with the same theme.
- Check the folders attackers prefer. wp-content/mu-plugins for files you did not put there, wp-content/uploads for any PHP file, and the theme's functions.php for code that was not there last month.
- Search the database. The wp_options table and post content for script tags or iframes. A changed siteurl or home value is a strong sign.
- Look in Google Search Console. Under Security issues, Google reports what it found, often before anyone told you.
Why the small sites are the ones that get hit
Both research teams describe the same kind of victim: an ordinary site, often years old, with an outdated component and a login page open to the internet. Not the flagship shop that gets attention every week, but the brochure site from 2021 that still works and that nobody logs into. Campaigns like this are automated. They do not choose targets; they scan for the pattern. The defence is therefore not attention to the important sites but the same routine on every site, including the ones that feel too small to matter.
If you find it
Treat it as a full compromise, not a display bug, and follow the order in the hacked-site checklist: copy first, offline second, then credentials, administrators, files, entry point. Removing the overlay and moving on leaves the door open that let it in. Tell the site owner that visitors were exposed, in one plain sentence, so they can decide whether their customers need to hear it.
Sources
- Rapid7 Labs, "When Trusted Websites Turn Malicious: WordPress Compromises Advance Global Stealer Operation", analyst Milan Spinkarapid7.com, published 10 March 2026
- Check Point Research, "Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect", researcher Jaromír Hořejšíresearch.checkpoint.com, August 2026
- The Hacker News, "StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data"thehackernews.com, August 2026