StopAndProtect exploits 2,000 WordPress sites to steal crypto wallets

The geographic spread of the campaign is wide. Of the 6,000-plus unique IP addresses flagged as of July 24, the US accounted for the largest share at 1,852 addresses, followed by Russia and India at 630 each.

Check Point researchers accessed more than 31,000 screenshots captured from victims' machines, along with directories containing up to 700 stolen data archives. Those screenshots and logs gave researchers a detailed map of the attackers' targeting methods and the scope of data they had already harvested.

What makes StopAndProtect different from garden-variety ransomware is its hybrid approach. Rather than simply encrypting files and demanding payment, the operation combines selective file encryption with extensive data theft and ongoing user surveillance. The ransomware component encrypts enough to cause pain, but the real value for the attackers appears to be the steady stream of stolen credentials, wallet files, and screenshots flowing back to their infrastructure.

The deliberate targeting of cryptocurrency wallet files elevates this from a generic malware campaign to a direct threat against digital asset holders. The malware's data exfiltration modules are specifically designed to hunt for wallet files on infected machines, meaning anyone who stores private keys or seed phrases on a device that visits a compromised site is a potential target.

WordPress site administrators have a role to play in shrinking the attack surface. The fact that so many of the compromised sites were running software with known vulnerabilities from half a decade ago suggests that basic patch management would have prevented a significant portion of this campaign's infrastructure from ever being established.

Check Point's ability to access the attackers' own stolen data troves may accelerate law enforcement response and victim notification efforts. Researchers accessed more than 31,000 screenshots from infected machines, along with up to 700 stolen data archives, they said.