A cybercrime operation called StopAndProtect quietly turned nearly 2,000 legitimate WordPress websites into a distributed attack network that spreads malware, steals crypto wallet files, monitors victims through screenshots, and deploys ransomware when the operators decide a target is worth squeezing harder. Check Point Research published the findings on August 18 after tracing what initially looked like a standalone ransomware family back to something far more organized.

The scale is significant. By July 24, researchers had logged infections across more than 6,000 distinct IP addresses, with the heaviest concentration in the United States (1,852), followed by Russia and India (630 each). Between mid-May and late July, the operation…