Researchers uncovered a large campaign called StopAndProtect that uses hacked WordPress sites to show visitors a fake CAPTCHA and trick them into running a PowerShell command. That one action kicks off a multi-stage infection that can encrypt files (ransomware), steal documents, passwords/wallet data, and upload screenshots and logs back to attacker-controlled infrastructure hosted on compromised WordPress domains.
The StopAndProtect campaign relies on a technique known as ClickFix, where a compromised but legitimate-looking website displays a fake CAPTCHA verification prompt. Instead of the usual click-a-box interaction, the prompt instructs the visitor to copy and paste a PowerShell command into their computer to "verify" access. Once executed, that single command kicks off a multi-stage infection chain that can encrypt files, steal documents and credentials, lock the screen, and upload screenshots and logs to attacker infrastructure.
What makes this campaign notable is its scale. Researchers found that thousands of hacked WordPress sites were being used not just to host the malicious CAPTCHA pages, but also as command-and-control infrastructure and storage for stolen data. A stealthy WordPress must-use plugin was even used to create a hidden REST API upload endpoint with hardcoded credentials, allowing stolen data to be quietly funneled back through legitimate-looking domains.
The attack succeeds because it exploits a moment of routine trust. CAPTCHA prompts are a normal part of browsing the web, so a fake one blends in easily, especially when it appears on a website visitors have no reason to distrust. The ask, copying and pasting a command, feels small and technical rather than dangerous, which lowers people's guard compared to more obvious phishing attempts like suspicious links or attachments.
On the infrastructure side, the campaign benefited from outdated WordPress installations. Researchers noted many vulnerable sites remain unpatched simply because owners do not keep them updated, giving attackers a large pool of legitimate-looking domains to hijack.
Organizations can reduce risk with a few practical steps:
Because this campaign blends a familiar web interaction with a technical payload delivery method (see MITRE ATT&CK T1204.001 and T1059.001), awareness training that specifically addresses ClickFix-style prompts is one of the most direct ways to reduce exposure.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a large-scale operation that uses thousands of hacked WordPress sites to show visitors a fake CAPTCHA, tricking them into running a PowerShell command that starts a multi-stage infection involving ransomware and data theft.
When a user visits a compromised website, a ClickFix-style prompt appears asking them to verify they are human by copying and pasting a PowerShell command, which actually launches malware on their machine.
The toolkit is modular and can encrypt files, silently steal documents and passwords, lock the screen, spread via SMB or USB, and upload screenshots and logs back to attacker-controlled infrastructure.
Keeping WordPress and its plugins updated is critical, since researchers found compromised sites running outdated WordPress versions that made them easy targets for hijacking.
You land on a normal WordPress site and a CAPTCHA pops up… but instead of clicking a box, it tells you to run a PowerShell command. That’s the StopAndProtect campaign. One ClickFix-style fake CAPTCHA, one copied PowerShell command, and you’ve kicked off a multi‑stage infection that can steal documents, passwords, screenshots, even encrypt your files. Here’s the tell: a real CAPTCHA never needs PowerShell. If a page says, 'CAPTCHA verification required. Follow the steps to continue (copy/paste the PowerShell command),' that’s not security, that’s social engineering. If any website tells you to copy and run a PowerShell or Terminal command to pass a CAPTCHA or verification, stop, close the tab and report it to IT or security immediately.
Check Point says North Korea’s Lazarus Group targeted defense and aerospace professionals using convincing fake job offers that led victims to download trojanized PDF software. The campaign used a Windows zero-day (now patched as CVE-2026-68820) to gain full control and hide from security tools,…
Researchers describe a real, ongoing Lazarus-linked campaign where targets are lured with attractive job offers and tricked into downloading a PDF viewer and “job description” documents. Opening the files installs backdoors and, in at least one wave, attackers used a Windows zero-day to gain deep…
Researchers observed an active campaign where attackers used Microsoft Teams to impersonate IT support and trick a user into running a PowerShell command. That action downloaded a malicious package that enabled credential theft (via a fake lock screen) and helped attackers move through internal…
Researchers described an active phishing campaign that tricks people with fake Adobe/Zoom update and “document review” themes to install the legitimate ScreenConnect remote-access tool. Once installed, attackers get persistent remote control of the victim’s computer while blending in as normal IT…
Researchers reported a real phishing campaign (“Operation BlueDash”) that tricks users with a “secure document” lure and routes them to a fake Microsoft Store page that claims Microsoft Teams must be updated. The download installs legitimate remote access tools (Level RMM and ScreenConnect) so…
CERT-UA reports a Sandworm-linked group (UAC-0145) is using fake CAPTCHA checks on compromised websites to persuade Ukrainian visitors to run PowerShell commands that infect their own computers. The campaign also includes Android attacks where victims are sent trojan APK “security tools” via…
