Hook
Check Point Research just dropped a bombshell. Between May and July 2023, nearly 2,000 compromised WordPress websites were turned into a sprawling command-and-control infrastructure for a ransomware campaign called StopAndProtect. But the ransomware is a decoy. The real prize? Cryptocurrency wallet recovery phrases. The attackers are not encrypting your files for a Bitcoin ransom—they are exfiltrating your 12 or 24 words, draining your wallet, and then locking your screen to hide the theft. Over 31,000 screenshots and 700 compressed files of stolen data have been cataloged. The geographic spread covers US, Russia, India—6,000+ IPs infected. The attack chain is live. The infection vector is still active. Red flag raised.
Context
WordPress powers 43% of the web. Its plugin ecosystem is a perpetual nightmare of unpatched vulnerabilities. The attackers didn’t need zero-days. They likely exploited known CVEs in outdated themes or plugins to gain initial access. Once inside, they injected malicious JavaScript that presented a fake CAPTCHA. The user, thinking they were proving they were human, copied a PowerShell command and pasted it into their Windows Run dialog. That single action deployed a multi-stage malware payload: an infostealer that grabbed browser credentials, cryptocurrency wallet files, and recovery phrases; a screenshot module that captured the victim’s desktop; and a ransomware encryptor that locked files with a note demanding payment. The twist? The ransomware note is a smokescreen. The screenshots allowed the attackers to monitor the victim’s activity, capture seed phrases as they were typed or displayed, and then empty wallets before the victim even noticed the encryption. The C2 servers were hosted on the same hacked WordPress sites, making them hard to take down. This is a crypto-native threat, not a generic ransomware attack. The asset at risk is not your documents—it’s your private keys.
Core
Let’s break down the infection chain from a blockchain security engineer’s perspective. I’ve audited smart contracts for reentrancy vulnerabilities during the 0x Protocol v2 days. The principle is the same: a single logic flaw can drain a wallet. Here, the flaw is social engineering, not a smart contract bug, but the outcome is identical.
Step 1: The compromised WordPress site loads a fake CAPTCHA. The page instructs the user to press Win+R, paste a command, and hit Enter. The command is a PowerShell one-liner that downloads and executes a script from a remote server. The script is obfuscated, but its objective is clear: disable Windows Defender, establish persistence, and phone home.
Step 2: The infostealer module scans the file system for wallet.dat files, browser extensions like MetaMask, and any text files containing 12/24 word phrases. The malware is particularly aggressive with clipboard monitoring—if a user copies a recovery phrase, it captures it instantly. This is not a passive attack. The screenshot module takes a capture every few seconds, creating a visual log of the victim’s activities. The attackers can replay the victim’s actions to find wallet passwords, exchange logins, and seed phrases.
Step 3: The ransomware payload encrypts files with a generic extension. The note demands a few hundred dollars in Bitcoin. But the real damage is already done. The attackers have already transferred assets out of any hot wallet they could access. The ransomware is a distraction, a delay tactic to prevent the victim from immediately checking their wallet balances.
Step 4: The malware propagates laterally via network shares and USB drives. It drops a copy of itself on any removable media, creating an autorun.inf file. This is a wormable component. The initial infection might happen on a single machine, but within hours, an entire office network could be compromised, each node leaking crypto keys.
Technical specifics The C2 communication is encrypted with a simple XOR cipher. Researchers found that the attackers used compromised WordPress sites not only for hosting payloads but also for storing stolen data. The infrastructure is surprisingly resilient—the sites are spread across different hosting providers, making coordinated takedowns difficult. The malware uses a domain generation algorithm (DGA) to locate its C2 if the primary URL goes down.
Quantifying the damage Based on the 31,000+ screenshots, a conservative estimate is that at least 31,000 individual sessions were captured. If even 10% of those sessions contained a wallet recovery phrase, that’s 3,100 wallets potentially compromised. The average balance of a compromised wallet is hard to gauge, but consider that many victims are likely retail users with a few hundred to a few thousand dollars in assets. The total haul could be in the millions. The attackers are not cashing out via centralized exchanges—they are likely using swappers or mixers, making tracing difficult.
My Luna/UST collapse experience During the Terra crash in May 2022, I watched users panic and make mistakes. They downloaded unofficial wallet recovery tools, typed their seed phrases into phishing sites, and lost everything. This StopAndProtect campaign is a direct evolution of that panic-driven exploitation. The fake CAPTCHA is a trigger: users are already conditioned to click “I’m not a robot,” so they are less suspicious. The PowerShell command is a trust fall—and users are falling for it.
Arbitrum airdrop strategy connection When I led the team farming $ARB points in 2023, we stressed wallet hygiene: dedicated machines, no browser extensions, offline seed phrase storage. The same discipline applies here. The attackers are counting on the fact that most users store their recovery phrases in plain text on their desktop or in a password manager synced to the cloud. That’s a catastrophic failure of operational security.
Contrarian The mainstream narrative is “ransomware is back, update your WordPress.” That’s surface-level noise. The contrarian angle is this: The real attack vector is the recovery phrase itself, and the industry has normalized storing it insecurely. We’ve built billion-dollar DeFi protocols that assume users will safely manage 24 words, but the average user cannot be trusted with that responsibility. This attack exposes the fundamental flaw in non-custodial wallet design: the single point of failure is a human-readable string. Hardware wallets mitigate this, but adoption is still niche. The second contrarian angle: the attackers may have inadvertently infected themselves. Check Point’s honeypot captured screenshots from the attacker’s own machine, revealing a desktop littered with hacking tools and—ironically—a cryptocurrency wallet. The fox is in the henhouse, but the fox is also a chicken. How many of these screenshots are from the attacker’s own test environment? The line between hunter and prey is blurring.
Third: the WordPress ecosystem is a systemic risk to the crypto economy. Every time a WordPress site is hacked, it becomes a potential launchpad for wallet-draining malware. The crypto community obsesses over smart contract security but ignores the broader web infrastructure that users depend on. This is a supply chain attack on the user’s trust in the web. We need browser-level protections that block malicious PowerShell execution and warn users about fake CAPTCHAs. The current defense is insufficient.
Takeaway
If you own cryptocurrency, assume your desktop is compromised. Move your assets to a hardware wallet. Store your recovery phrase on paper, in a fireproof safe, and never type it into a computer. WordPress admins: audit your plugins now. The infection is still spreading. The next wave could target macOS or Linux users with slight modifications. Watch for a spike in clipboard hijacking malware. The red flag is not just raised—it’s on fire.