Thousands of Hacked WordPress Sites, One Operation Unmasking...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://research.checkpoint.com/2026/thousands-of-hacked-wordpress-sites-one-operation-unmasking-stopandprotect
• Blog Title: Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect
• Suggested Section: Network Services Pentesting > 80,443 - Pentesting Web Methodology > WordPress, under a new subsection for MU-plugin persistence and hidden REST upload backdoors; cross-reference Phishing Methodology > Clipboard Hijacking/ClickFix and Windows PowerShell post-exploitation

🎯 Content Summary

Operation overview

StopAndProtect is a large-scale Windows malware operation combining ransomware, selective document theft, password and wallet theft, keylogging, screenshots, WhatsApp contact collection, screen locking, lateral movement, removable-media propagation, and attacker-to-victim chat. The operators abuse hacked WordPress installations as ClickFix delivery pages, malware hosts, command-and-control (C&C) servers, telemetry collectors, and storage for stolen documents, sc...

🔧 Technical Details

ClickFix clipboard execution: A compromised page can overlay legitimate content with a fake verification prompt, place a PowerShell command in the clipboard using navigator.clipboard.writeText(), and instruct the visitor to paste and execute it. A command combining -w hidden, -ep bypass, Net.WebClient.DownloadString(), and IEX hides the console, requests execution-policy bypass, downloads script text, and executes it without first writing a conventional executable payload to disk.

Reflection-based in-memory .NET loading: A PowerShell loader can Base64-decode a .NET assembly, load it into memory, enumerate its types and methods, locate a static parameterless entry point with a predictable name such as Execute, and invoke it through reflection. This creates a modular loading interface and reduces executable-file artifacts on disk.

WordPress MU-p...

🤖 Agent Actions

Updated src/network-services-pentesting/pentesting-web/wordpress.md with:

• MU-plugin persistence behavior and stealth properties.
• Hidden REST upload backdoors leading to arbitrary PHP write/RCE.
• Investigation commands for MU plugins, REST routes, and dangerous file operations.
• Detection indicators for self-deleting installers, text-controlled campaign switching, and cache disabling.
• Cross-references to existing ClickFix and PowerShell coverage.
• Numbered references to official WordPress documentation and the Check Point research.

Validation passed: git diff --check, citation integrity, internal link paths, duplicate-section, and forbidden-source checks. mdbook was unavailable, so a full build was not run.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://research.checkpoint.com/2026/thousands-of-hacked-wordpress-sites-one-operation-unmasking-stopandprotect

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting > 80,443 - Pentesting Web Methodology > WordPress, under a new subsection for MU-plugin persistence and hidden REST upload backdoors; cross-reference Phishing Methodology > Clipboard Hijacking/ClickFix and Windows PowerShell post-exploitation".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0