Check Point Research said the StopAndProtect ransomware operation used nearly 2,000 compromised WordPress websites to distribute malware, steal data, monitor victims and deploy ransomware. The campaign was discovered in mid-May and had compromised more than 6,000 unique IP addresses as of July 24, according to the researchers. The United States accounted for 1,852 of those IPs, while Russia and India each had 630.
The report said the hacked websites were also used to host malware, send commands, and store stolen files, screenshots and activity logs. Researchers said the attackers relied on fake CAPTCHA prompts to trick Windows users into running PowerShell commands. That process was used to steal credentials and cryptocurrency wallet seed phrases, and the malware was able to spread through networks and USB devices.
Check Point Research said it collected more than 31,000 screenshots and over 700 compressed data archives during its investigation. The researchers also said the attackers may have accidentally infected themselves.
Check Point Research said the StopAndProtect ransomware operation used nearly 2,000 compromised WordPress websites to spread malware, steal data, monitor victims and deploy ransomware.
The campaign was discovered in mid-May. As of July 24, it had compromised more than 6,000 unique IP addresses, including 1,852 in the United States. Russia and India each accounted for 630.
How the hacked sites were used
According to Check Point Research, the compromised websites were used not only to host malware, but also to send commands and store stolen files, screenshots and activity logs.
Fake CAPTCHA prompts targeted Windows users
The researchers said the attackers used fake CAPTCHA pages to trick Windows users into running PowerShell commands. That enabled the theft of credentials and cryptocurrency wallet seed phrases, with the malware then spreading through networks and USB devices.
What researchers collected
Check Point Research said it collected more than 31,000 screenshots and over 700 compressed data archives. The firm added that the attackers may have accidentally infected themselves.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
