Researchers found a criminal operation (StopAndProtect) that used nearly 2,000 hacked WordPress sites as a delivery network. Visitors were shown a fake CAPTCHA that pressured them to copy and run a PowerShell command, which then installed malware that could steal data, capture screenshots, and sometimes deploy ransomware. The key risk is that a normal-looking website prompt can be the start of an infection if it asks you to leave the browser and run commands.
This operation, tracked as StopAndProtect, relied on nearly 2,000 compromised WordPress sites to distribute malware at scale. Visitors to these sites were shown a fake CAPTCHA verification prompt, a classic use of the ClickFix technique. Instead of a normal human-verification check, the prompt instructed users to copy a PowerShell command and run it on their own machine to continue browsing. Once executed, this command downloaded further malicious stages written in .NET, giving attackers a foothold on the victim's device.
The attack succeeded because it exploited two layers of trust at once. First, the hosting websites looked legitimate since they were real WordPress sites, often with outdated installs or plugins that had been quietly compromised. Second, the CAPTCHA format itself is something users encounter constantly and rarely question. By blending a familiar verification step with an unusual and dangerous instruction, the attackers bypassed the skepticism that a more obviously suspicious prompt might trigger. Many victims likely did not realize that being asked to leave the browser and open PowerShell was itself the red flag.
Organizations should train all employees, not just technical staff, to recognize that a real CAPTCHA never requires running commands on a computer. If a webpage asks someone to leave the browser and execute instructions, the correct response is to close it and report the incident rather than comply. IT and helpdesk teams should reinforce this expectation so that reports are taken seriously and investigated quickly, since these attacks often begin with silent data collection, including file listings and screenshots, before any encryption or screen locking occurs. Web and marketing teams managing company WordPress sites should also prioritize keeping installations and plugins updated, since outdated software was a key enabler of the initial compromise that turned trusted sites into unwitting attack infrastructure.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
ClickFix is a social engineering method where a fake CAPTCHA or verification prompt tells visitors to copy and run a PowerShell command to prove they are human, which actually installs malware.
Close to 2,000 compromised WordPress sites, often running outdated plugins, were used as shared infrastructure for malware hosting, command delivery, and stolen-file storage.
Close the page immediately and report it, since a legitimate CAPTCHA or verification step will never ask a visitor to open PowerShell or a terminal and run instructions.
No, in many cases the operators first collect file lists and steal specific files, with encryption or screen locking sometimes coming later rather than immediately.
You land on a normal-looking site, and a CAPTCHA pops up: “To verify you’re human, copy and run this PowerShell command.” This is the StopAndProtect scam. They hijacked nearly 2,000 outdated WordPress sites and use this fake CAPTCHA, a ClickFix trick, to talk you into running their PowerShell malware. Here’s the aha: a real CAPTCHA never tells you to open PowerShell or Terminal, paste a command, or turn off security. That’s how they quietly steal files, passwords, screenshots, and later can lock your screen or hit you with ransomware. If any web page tells you to run PowerShell or Terminal to keep browsing, stop right there, close the tab and report it to IT immediately.
Researchers described a real cybercrime operation (“StopAndProtect”) that compromised nearly 2,000 WordPress sites and used them to show fake CAPTCHA pages that trick visitors into running malicious commands. Victims can end up with malware that steals files and screenshots and, in some cases,…
Researchers observed real campaigns using compromised WordPress sites to show fake verification/BSOD-style prompts that trick users into running a copied PowerShell command. The technique (ClickFix) was paired with MaaS tools (ErrTraffic and Cruciferra) to deliver malware while attempting to kill…
South Korean agencies warned that a state-backed hacking group is actively targeting citizens and businesses using job-themed phishing emails and “watering hole” attacks on legitimate websites. The phishing lures include fake job applicants sending resume links and impersonated recruiters sending…
Microsoft observed real-world campaigns where victims were tricked by “ClickFix” prompts into pasting a command into Windows Run, which then installed ACR (Amatera) Stealer. The malware steals saved browser passwords, live session tokens, and Microsoft 365/OneDrive/SharePoint files, meaning…
A state-sponsored campaign in South Korea used spear-phishing and hacked “trusted” local websites to infect visitors who had vulnerable AnySign4PC installed. In some cases, simply visiting a compromised page triggered the exploit and installed SIGNBT or COPPERHEDGE backdoors without any download…
Researchers uncovered a large campaign called StopAndProtect that uses hacked WordPress sites to show visitors a fake CAPTCHA and trick them into running a PowerShell command. That one action kicks off a multi-stage infection that can encrypt files (ransomware), steal documents, passwords/wallet…
