wordpress

Cybersecurity company Check Point Research discovered that the StopAndProtect ransomware campaign uses nearly 2,000 compromised WordPress sites to spread malware, steal data, monitor victims, and deploy ransomware. This campaign was identified in mid-May. As of July 24, it has compromised over 6,000 unique IP addresses, including 1,852 in the United States, and 630 each in Russia and India.The compromised websites were also used to host malware, send commands, and store stolen files, screenshots, and activity logs. Attackers lure Windows users into running PowerShell commands through fake CAPTCHAs, thereby stealing credentials and cryptocurrency wallet recovery phrases, and spreading through networks and USB devices. Researchers have collected over 31,000 screenshots and more than 700 data compression packages, and believe that the attackers may have inadvertently infected themselves.

ChainCatcher message, recently attackers have exploited vulnerabilities in WordPress plugins to attack normal sites, injecting malicious js code into the sites, launching watering hole attacks that pop up malicious windows when users visit the site, tricking users into executing malicious code or signing Web3 wallets, thereby stealing users' assets.It is recommended that sites using WordPress plugins check for vulnerabilities, update plugins in a timely manner to avoid being attacked; users should carefully identify the downloaded programs and the content of Web3 signatures when visiting any site to avoid downloading malicious programs or authorizing malicious signatures that could lead to asset theft.