Hacked WordPress Sites Spread Ransomware, Steal Crypto Wallets

TREE NEWS reports: Check Point Research uncovered a StopAndProtect ransomware campaign that exploited nearly 2,000 compromised WordPress sites to spread malware, steal data, and deploy ransomware. The operation, active since mid-May, has breached over 6,000 IPs, with attackers using fake CAPTCHAs to trick Windows users into running PowerShell commands that steal credentials and crypto wallet seed phrases. Researchers collected over 31,000 screenshots and 700 data archives, noting the attackers may have accidentally infected themselves.