StopAndProtect ransomware exploits nearly 2000 WordPress websites to steal cryptocurrency

Check Point Research has found that the StopAndProtect ransomware utilizes nearly 2000 hacked WordPress websites to spread malware and steal cryptocurrency wallet mnemonic words. As of July 24th, this operation has invaded over 6000 independent IP addresses, including 1852 in the United States, 630 each in Russia and India. The attacker induced users to run PowerShell commands through false CAPTCHA, collecting over 31000 screenshots and more than 700 compressed data packets. （Decrypt）