On August 21, 2024, Check Point Research published a teardown of a ransomware campaign designated "StopAndProtect." The headline numbers: 1,971 compromised WordPress sites, 6,000+ infected IPs, 31,000 screenshots exfiltrated, 700+ archive files collected. The campaign stole cryptocurrency wallet recovery phrases through a fake CAPTCHA page that instructed Windows users to paste a PowerShell command into their terminal.
This is not a sophisticated zero-day exploit. This is not a novel cryptographic break. This is a social engineering pipeline that weaponizes user compliance. And it worked.
I spent the last decade dissecting tokenomic failures and protocol-level rug pulls. The math there is often messy but predictable. This attack is different. It targets the layer most blockchain analytics cannot see: the user's own machine. Every wallet is only as secure as the environment where its seed phrase lives. StopAndProtect proves that the weakest link is not the smart contract. It is the user who copies a command from a website because a checkbox told them to.
Context: The WordPress Botnet as a Delivery Vehicle
WordPress powers over 40% of the web. That makes it the largest single content management system on the internet. It also makes it a permanent target for mass exploitation. The StopAndProtect campaign did not need to attack every website individually. It compromised a batch of vulnerable WordPress installations, using them as a distributed command-and-control layer.
The attack flow is straightforward:
- Attacker compromises a WordPress site via a known plugin or theme vulnerability. No zero-day required, just unpatched code.
- The compromised site serves a JavaScript overlay that presents a fake CAPTCHA verification. The page claims the user must verify they are human before proceeding.
- The CAPTCHA provides a PowerShell command. The user is instructed to open Windows PowerShell, paste the command, and run it.
- The command downloads and executes a dropper that installs the StopAndProtect ransomware and a credential-seeking stealer.
- The stealer scans for cryptocurrency wallet files, browser cookies, and saved passwords. It captures the clipboard and takes screenshots at regular intervals.
- The ransomware then encrypts files and demands payment, often in Monero or Bitcoin.
The use of WordPress as the hosting layer for both malicious binaries and stolen data is elegant in its banality. Attackers do not need to maintain expensive infrastructure. They rent a fleet of compromised websites, and they discard them once detected. The campaign ran from May through July 2024, with at least 6,000 unique IPs confirmed infected. The 31,000 screenshots suggest an automated surveillance operation, not a manual hit-and-run.
What makes this particularly dangerous is that the target is not the financial elite. These fake CAPTCHAs appear on a wide range of sites, many of them tied to web forums, small business pages, and low-traffic blogs. An ordinary user who simply wants to leave a comment is suddenly told to run a system command. The instruction is masked as a "verification" step. To a non-technical person, it looks official.
The cryptocurrency angle is the sharp edge. The stealer explicitly searches for wallet recovery phrases, not just keys. It looks for files named "seed.txt," "recovery.txt," "backup phrase," and similar patterns. It also scans browser storage for extensions like MetaMask or Phantom. Once the recovery phrase is captured, the attacker can restore the wallet on their own device. The funds are gone, and the blockchain shows no suspicious contract interaction. It is simply another valid owner moving assets.
Core: Breaking Down the Attack Chain
I reverse-engineered several ransomware samples during the 2020 DeFi summer, when Harvest Finance suffered a $30 million exploit. The attack vector there was a flash loan manipulation, a technical flaw in the contract logic. StopAndProtect is a different beast. The technical complexity is moderate, but the operational execution is ruthless.
The Social Engineering Trigger
The central manipulation is the fake CAPTCHA. CAPTCHAs are designed to prove that a user is human. They are a trust anchor embedded in the web experience. For years, users have been conditioned to follow instructions from these widgets: click on traffic lights, type hidden characters, wait for a verification tick. The StopAndProtect campaign hijacks that trust.
The exact instruction printed is something like: "Press Windows+R, type powershell, then copy and paste the command below." There is no malware file to download. There is no suspicious link to click. The user is asked to execute a command directly. For a non-technical user, the command looks like a string of incomprehensible numbers and letters. In their mind, they are simply following a step to prove they are human.
That command, when run, reaches out to the compromised WordPress server, downloads a base64-encoded payload, and executes it in memory. This is a well-known technique: fileless malware execution. No disk artifact initially, which evades many traditional antivirus scans.
The PowerShell Payload
The payload performs several functions sequentially. First, it establishes persistence by creating a scheduled task that runs at user login. Second, it attempts to disable Windows Defender by modifying registry values. Third, it drops the StopAndProtect ransomware binary. Fourth, it deploys a credential stealer that collects:
- Browser cookies and saved passwords from Chrome, Firefox, Edge
- Cryptocurrency wallet files, including those from the wallet directories of Electrum, Exodus, Atomic, and similar desktop wallets
- Clipboard text, which is often used to paste wallet addresses during transactions
- Screenshots every few seconds, capturing whatever is on the screen at that moment
Why 31,000 screenshots? This is the key insight. Attackers are not just stealing data; they are monitoring user behavior in real time. They capture the moment a user opens a wallet app, views their seed phrase, or types their password. The screenshots provide contextual intelligence. If a user enters a recovery phrase into a form, the attacker sees it immediately. Even if the stealer misses the specific file, the screenshot records the phrase on the screen.
The 700+ archive files suggest a systematic exfiltration. Stolen data is compressed into ZIP files and uploaded to one of the compromised WordPress servers. The attacker later retrieves these archives. This pattern is common in extortion campaigns, where the attacker threatens to leak sensitive files if the ransom is not paid.
Network and USB Propagation
Most ransomware stops at network encryption. StopAndProtect goes further. The researchers observed that the malware attempts to propagate through SMB shares and removable USB drives. This is a deliberate strategy. If the user is on a corporate network, the malware can spread to other Windows machines. If the user plugs a USB drive into an infected computer, the drive is instantly infected with an autorun script. This is not a technical innovation; it is a standard worm technique. But it expands the blast radius beyond a single user.
The WordPress Infrastructure Factor
The scale of the operation is constrained by the availability of vulnerable WordPress sites. The campaign had nearly 2,000 at its peak. Each site acts as a hosting point for the malicious payload and a storage server for stolen data. The attacker does not need to pay for hosting or cloud services. Every compromised site is a free resource.
From a risk management perspective, this is a distributed infrastructure that is difficult to takedown. Law enforcement can seize one domain, but the attacker moves to the next compromised site. The resilience comes from the sheer number of unpatched WordPress installations. Security is not the foundation here; the foundation is negligence.
The Targeting of Recovery Phrases
This is not random theft. The attacker specifically targets cryptocurrency recovery phrases. The malicious code contains string searches for words like "seed," "phrase," "mnemonic," and "wallet back up." It is looking for the one piece of information that grants total control over a wallet. Not a private key file, not an address, but the mnemonic phrase itself.
Why the phrase? Because it is portable. A private key file may be encrypted; a recovery phrase is plain text. The phrase can be typed into any wallet interface, and the attacker can immediately generate the corresponding private keys. There is no second factor, no password prompt, no time delay. The phrase alone is the key.
The attacker likely receives a stream of phrases and checks each one for a non-zero balance. Scripts auto-sweep assets to a centralized address as soon as funds are detected. This is a fully automated harvesting operation. The user may not notice anything until they open their wallet and find it empty.
The Economic Model of the Attack
Let me attach some numbers. The average ransomware demand is around $3,000 per victim. But the real value is in the stolen crypto. If only 1% of the 6,000 infected users hold more than $1,000 in crypto, that is $60,000 in easy theft. Screenshots and stolen files can also be sold on dark web markets. The attack is not a get-rich-quick scheme; it is a scalable revenue stream.
From the attacker's cost perspective, the outlay is minimal. The malware code itself appears to be a variant of older ransomware families, likely purchased or downloaded from a crime forum. The WordPress compromise is facilitated by simple credential stuffing, taking advantage of reused passwords. The only real cost is time. This makes the return on investment extremely high.
Contrarian: What the Research Got Right and What We Miss
Security researchers often paint attacks as omnipotent. The typical narrative says: "Users are doomed; attackers are all-powerful." But there are counter-intuitive angles that deserve attention.
The most interesting detail in the Check Point report is the hypothesis that the attacker accidentally infected themselves. The researchers discovered that the malware was configured to avoid encrypting certain directories that contained the attacker's own C2 scripts. This suggests sloppy operational security. The attacker might have run the same fake CAPTCHA on their own test machines and inadvertently compromised their infrastructure.
This is a crack in the facade. The same social engineering trick that caught ordinary users was not executed with enough technical rigor to protect the attacker. Emotion is the variable that breaks the model. Trust in the fake CAPTCHA worked too well, and even the creator got caught in the trap.
The second blind spot is the security community's fixation on finding new malware variants. Everyone wants a zero-day. But StopAndProtect is not new. It is built on open-source or cheaply bought code, using years-old PowerShell techniques, and it targets WordPress plugins that have been vulnerable since 2022. The success of the campaign is not due to technical brilliance. It is due to widespread user ignorance and patching laziness.
And this leads to the third point: the attackers are not as sophisticated as they appear. The massive screenshot collection and 700 zip files are impressive, but they are bulk, not selectivity. A truly professional operation would filter for high-value wallets, not screenshot every user's screen. The campaign catches as many victims as possible, assuming that a small percentage will yield returns. It is a numbers game, not a precision strike.
In that sense, the bulls of the cryptocurrency industry are partially right. The blockchain itself is not directly harmed. No smart contract is exploited. No bridge is drained. The protocol layer remains intact. The attack is a reminder that crypto adoption was always limited by the user's ability to safely manage keys, not by the quality of the underlying technology. Hype burns out; structural integrity remains. But the structural integrity of the user experience is a different story.
Takeaway: The Seam in Every Rug
Every rug has a seam you missed. For SQL injection, it was a missing validation. For bridge exploits, it was an incorrect parameter check. For the StopAndProtect campaign, the seam is the gap between user trust and technical understanding.
No blockchain solution can fix a user who voluntarily pastes a malicious command into PowerShell. No protocol upgrade can protect a seed phrase that was typed into a website. The industry can build faster chains, cheaper transactions, and more robust consensus mechanisms, but a single phishing page can undo all of it.
Risk is not eliminated by ignoring it. Your wallet is not safe because you use a hardware wallet; it is safe only if the recovery phrase never touches a compromised screen. If you ever see a CAPTCHA asking you to run a command, close the tab. The math of this attack is trivial. The human cost is permanent.
The question is not whether another variant will appear. It already has. The question is whether users will finally learn that verification comes from understanding, not from following instructions.