Large-Scale Cyberattack: WordPress Sites Weaponized for Crypto Theft

I still remember the first hack I witnessed firsthand—a small but well-maintained blog suddenly overrun by strange pop-ups and a locked admin account. Back then, I thought, "That only happens to others." Until it happened to me. And that’s what makes this latest cyberattack so alarming: it doesn’t target obscure niche websites but the very platforms millions of us rely on daily. WordPress sites, which should be among the most trustworthy sources on the web.
A large-scale cyberattack has compromised nearly 2,000 WordPress websites, turning them into a criminal infrastructure. The attackers hijacked these sites to distribute malware, steal cryptocurrency wallet files, and execute ransomware attacks. Behind this scheme is the so-called StopAndProtect operation—a name that sounds almost too harmless for what was unfolding. Far from a minor crime, this was a well-organized cyber weapon.
How the Attacks Unfolded: From Vulnerabilities to Stolen Crypto
Security researchers at Sucuri uncovered the campaign and dissected the attackers' methods. What shocked me most was their exploitation of a well-known WordPress vulnerability—one that should have been patched long ago. By gaining admin access, they installed hidden backdoors, seizing full control of the sites. From there, it was smooth sailing: they redirected unsuspecting visitors to infected servers.
And what did they distribute? Malware like Raccoon Stealer or RedLine Stealer—programs designed to hunt for sensitive data. Not just login credentials or browser cookies, but cryptocurrency wallet files. For attackers, crypto is the ultimate prize: anonymous, difficult to trace, and often irretrievably lost for victims.
Crypto Theft: When Your Digital Wallet Runs Dry
The most insidious part? Attackers didn’t just target "hot" wallets—those connected to the internet—they also tried to extract private keys from cold storage. These are wallet files stored offline on USB drives or hard disks, the safest method of storage. But if cybercriminals gain access to the computer where these files are kept, they can be stolen. The pilfered data is then sold on darknet markets or used for illegal transactions.
Experts estimate the attackers may have already stolen hundreds of thousands of euros through this method. But as with most cybercrime cases, the true scale is likely much higher. Many victims never realize they’ve been hit—or, fearing reputational damage, never report the incident.
Ransomware: When Extortion Strikes
Beyond crypto theft, the cybercriminals a



lso relied on classic extortion. They encrypted the servers of hijacked websites and demanded ransom payments in Bitcoin or other cryptocurrencies. Since many WordPress sites host mission-critical content—online stores, ad-supported blogs, or customer service platforms—operators often had no choice but to pay to regain access.
Ransom demands typically ranged in the mid-five figures, and attackers leveraged crypto’s anonymity to conceal their identities. A despicable scheme that underscores just how brazen these attacks have become.
WordPress: A Perennial Target for Cyberattacks
The StopAndProtect campaign is far from an isolated incident. WordPress is one of the world’s most popular content management systems—and that popularity makes it a prime target for attackers. From small blogs to large e-commerce platforms, over 40% of all websites run on WordPress. And that massive footprint makes it a lucrative hunting ground.
The most common vulnerabilities? Outdated plugins, missing security updates, or weak passwords. Many site owners underestimate the risks and fail to update their systems regularly. Yet simple measures like two-factor authentication or regular backups could provide effective protection.
What You Can Do: Simple Steps, Big Impact
I know how overwhelming security warnings can feel as a non-expert. But you don’t need to be an IT specialist to protect your WordPress site. Here are steps anyone can take:
1. Update, update, update! Yes, it’s tedious, but keeping WordPress, themes, and plugins current closes most security gaps.
2. Strong passwords and 2FA. A password like "123456" is about as secure as a cardboard door. Use complex passwords and enable two-factor authentication to make life harder for attackers.
3. Use security plugins. Tools like Wordfence or Sucuri Security offer real-time protection and alert you to suspicious activity. Yes, setup takes time—but it could save you from a world of trouble.
4. Back up regularly. Think of backups as insurance for your website. If something goes wrong, you can restore your site quickly.
5. Monitor your site. Use tools like Google Search Console or Sucuri SiteCheck to detect suspicious changes early.
Final Thought: Vigilance is the Best Defense
The StopAndProtect operation is yet another reminder of how sophisticated cybercriminals have become. But with basic precautions, you can significantly reduce your risk. Stay alert, update diligently, and don’t give attackers an easy target. In the digital world, caution is your strongest shield.