Experts warn 2,000 hacked WordPress sites were secretly running a global crime ring

Researchers uncover vast cybercrime ring running on computers and infected domains where outdated versions of WordPress were installed The StopAndProtect investigation revealed the WordPress content management system was key to the ring’s success; both the core software and third-party plugins were

<![CDATA[ <article> <ul><li><strong>Researchers uncover vast cybercrime ring running on computers and infected domains where outdated versions of WordPress were installed</strong></li><li><strong>The StopAndProtect investigation revealed the WordPress content management system was key to the ring’s success; both the core software and third-party plugins were subverted</strong></li><li><strong>Around 2,000 WordPress sites were hijacked by the cybercrime ring</strong></li></ul><p>Check Point Research has unearthed a global cybercrime ring that relied on a network of WordPress websites. The investigation into an operation dubbed “StopAndProtect” found a network of 5,000 infected computers around the globe, and 2,000 WordPress domains.</p><p>WordPress currently provides content management for around 43% of websites worldwide, making it the most significant CMS available. It is also the most popular website builder, and is suitable for single page websites, basic blogs, vast news sites, and even online stores.</p><p>The researchers <a href="https://blog.checkpoint.com/research/the-mistake-that-exposed-a-global-cyber-crime-operation/" target="_blank">found</a> the crime ring had made some mistakes, which alerted them to their operation. These included screenshots and logs of victims, internal tools, and files referencing the hijacked domains. While reassuring, the StopAndProtect investigation raises questions about the security of WordPress sites.</p><h2 id="how-stopandprotect-did-it">How StopAndProtect did it</h2><p>WordPress has long been a target for hackers looking for an easy way to host malware and operate botnets, with several key incidents over the course of its history. However, the CMS remains free and open source, and is easy to setup thanks to installation scripts and web builder plugins.</p><p>While StopAndProtect was initially the name given to the ransomware uncovered by Check Point Research earlier in 2026, they decided to use the name for the whole operation, as they found it doesn’t only distribute ransomware.</p><p>Check Point Research’s Eli Smadja <a href="https://research.checkpoint.com/2026/thousands-of-hacked-wordpress-sites-one-operation-unmasking-stopandprotect/" target="_blank">said</a>: “StopAndProtect shows how attackers can turn thousands of poorly maintained WordPress sites into a distributed criminal infrastructure for malware delivery, surveillance, data theft, and ransomware.”</p><h2 id="can-any-wordpress-domain-be-hijacked">Can any WordPress domain be hijacked?</h2><p>Given the number of WordPress sites impacted by the crime ring uncovered by the investigation, and the platform’s prominence in the CMS and web builder market, the question has to be asked: is WordPress still safe?</p><p>“Based on our research findings, we urge organizations be cautious of unexpected CAPTCHA prompts that instruct them to copy, paste, or run commands, keep their devices and security software updated, and immediately leave any website that asks them to perform unusual steps outside the browser," Smadja added.</p><p>Many small businesses rely on WordPress for their public-facing web presence, and in some cases for internal purposes too. The StopAndProtect investigation highlighted a particular WordPress-driven site running a five-year-old version of the CMS, compromised by around 40 vulnerabilities. </p><p>If concerns surround WordPress, the quickest solution is to ensure the website is running the most recent version, and that the plugins are not only running as intended, but also fully updated.</p><p>Maintaining a regular WordPress update cycle can avoid sites becoming hijacked, a strategy best used in conjunction with a web host that monitors for intrusions and suspicious activity.</p> </article> ]]>