THOUSANDS OF HACKED WORDPRESS SITES, ONE OPERATION: UNMASKING STOPANDPROTECT

Summary from the TLDR InfoSec newsletter

A massive malware operation leveraging 2,000 compromised WordPress sites is tricking visitors with fake Cloudflare CAPTCHAs to execute malicious PowerShell commands. Researchers attributed the sprawling campaign to a single operator who accidentally infected their own machine, leaking their Visual Basic 6 management tools and exposing over 6,000 victim IPs. Security teams should proactively hunt for anomalous must-use plugins like wp-sec.php and strictly enforce WordPress patching to prevent infrastructure hijacking.