TLDR Tech / InfoSec
Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect
A massive malware operation leveraging 2,000 compromised WordPress sites is tricking visitors with fake Cloudflare CAPTCHAs to execute malicious PowerShell commands. Researchers attributed the sprawling campaign to a single operator who accidentally infected their own machine, leaking their Visual Basic 6 management tools and exposing over 6,000 victim IPs. Security teams should proactively hunt for anomalous must-use plugins like wp-sec.php and strictly enforce WordPress patching to prevent infrastructure hijacking.
Read the full story