StopAndProtect Campaign Hijacks 2,000 WordPress Sites to Steal Personal Health and Medical Files
StopAndProtect abuses nearly 2,000 outdated WordPress sites to deliver a modular malware suite focused on data theft rather than widespread encryption. Stolen files frequently contain personal health records, creating direct privacy and identity risks for affected individuals. Check Point's analysis of exposed logs reveals the campaign's scale and operational methods.
Defenders should prioritize WordPress patching and monitor for unusual PowerShell activity tied to CAPTCHA pages. Expect operators to refine the stealer with better sandbox evasion and expanded WhatsApp automation within the next quarter as logs reveal successful targeting patterns.
Check Point: 300+ additional healthcare-adjacent victims confirmed via exposed logs within 60 days.
Sources (3)
- [1]Primary Source(https://thehackernews.com/2026/08/stopandprotect-uses-nearly-2000-hacked.html)
- [2]Supporting Source(https://research.checkpoint.com/2026/stopandprotect-wordpress-infrastructure/)
- [3]Supporting Source(https://www.bleepingcomputer.com/news/security/stopandprotect-malware-uses-2000-wordpress-sites/)