Over 6,000 IP addresses have been compromised. Nearly 2,000 WordPress sites are now serving as command-and-control nodes for a ransomware operation that targets the single most vulnerable point in the crypto user’s security stack: the recovery phrase. This is not a smart contract exploit. It’s a brute-force assault on human behavior, masked by a fake CAPTCHA verification that asks the victim to paste a PowerShell command. The code compiles, but context reveals the exploit.
Check Point Research published the findings on August 21. The attack, dubbed “StopAndProtect,” began in May 2024 and remained active through July 24. The attack chain is deceptively simple: compromised WordPress sites redirect users to a fake CAPTCHA page. The user, believing they are verifying their humanity, copies a PowerShell command and executes it. That command downloads a malicious payload that steals credentials, crypto wallet recovery phrases, and screenshots of the desktop. The malware then propagates across the local network and via USB drives. The researchers collected over 31,000 screenshots and 700 archived files from the attacker’s infrastructure. The scale is industrial.
Context: The Shift from Protocol Exploits to User Exploits
The crypto industry has spent years building audited smart contracts, formal verification, and insurance pools. But the weakest link remains the human operating the wallet. The StopAndProtect campaign is a textbook example of a “social engineering + malware” cocktail that bypasses all on-chain security. The attacker does not need to break a bridge contract or find a reentrancy bug. They simply need to convince a user to run a PowerShell command. Once the recovery phrase is exfiltrated, the wallet is drained. The blockchain is immutable. The loss is final.
This attack is not novel in its malware mechanics—PowerShell droppers have been used for years. What is novel is the targeting of crypto recovery phrases at scale, combined with a synthetic WordPress botnet. The attackers turned a legitimate content management system into a distribution network. Every website running vulnerable plugins or themes became a potential vector. Based on my audit experience, the initial compromise likely exploited known plugin vulnerabilities, not zero-days. The attacker’s code is not audited—it is designed to evade detection, not to pass a security review.
Core: A Systematic Teardown of the Attack Chain
Let me break down the attack into its constituent parts, each of which represents a failure point in the user’s digital hygiene.
Step 1: WordPress Compromise. The attacker gains access to a WordPress site, likely through an outdated plugin or weak admin credentials. The site is then used to host a fake CAPTCHA page. The domain is legitimate—the user trusts the site. This is a classic watering hole attack, but with a crypto twist.
Step 2: The Fake CAPTCHA. The page displays a standard “I am not a robot” checkbox. When clicked, a new window appears with instructions to copy a command and paste it into Windows PowerShell (or Run dialog). The command is obfuscated. The user is told this is necessary to verify their humanity. In reality, the command downloads and executes a PowerShell script that connects to a command-and-control (C2) server.
Step 3: Payload Execution. The script delivers a multi-stage payload. It steals stored browser credentials, screenshots the active desktop, and specifically searches for files containing recovery phrases, wallet.dat files, or any text related to “metamask,” “ledger,” “seed,” “phrase,” etc. The malware also captures clipboard data, which is where users often paste addresses during transactions.
Step 4: Data Exfiltration. The stolen data is sent to the C2 server, which is also hosted on compromised WordPress sites. The researchers saw over 31,000 screenshots—meaning thousands of users had their desktop activity captured in real-time. The 700+ archived files contain compressed collections of stolen wallet data, credentials, and personal documents.
Step 5: Ransomware Deployment. After data theft, the malware deploys the “StopAndProtect” ransomware. It encrypts files on the local machine and any connected network drives. The ransom note demands payment in Bitcoin. But the crypto theft has already happened—the ransomware is a secondary monetization layer. The real damage is the recovery phrase theft.
Step 6: Propagation. The malware spreads via USB drives and network shares. It copies itself to removable media, ensuring that even an air-gapped machine can be infected if the user plugs in a compromised USB. This is a classic worm-like behavior, but adapted for the crypto world.
Forensic Scrutiny: The Wash Trading Index for User Security
I have been tracking security incidents since the 2017 ICO era. In my 2020 DeFi yield verification, I learned that high yields are often a mask for underlying debt. In the same way, the “StopAndProtect” campaign reveals that user security is a debt that the crypto ecosystem has been kicking down the road. The attack is not a vulnerability in any protocol—it is a vulnerability in user behavior. But that does not make it any less dangerous.
Let’s examine the numbers. Over 6,000 IP addresses were compromised. The researchers collected 31,000 screenshots. If even 1% of those screenshots contained a visible recovery phrase, that is 310 wallets drained. The actual number is likely higher. The attackers specifically targeted crypto users—they did not just steal random credentials. The fake CAPTCHA page was designed to trigger only when the user visited a crypto-related site or searched for wallet software. This is targeted phishing at scale.
The attack also highlights the failure of WordPress as a platform. The Content Management System powers over 40% of the web, but its plugin ecosystem is a security nightmare. The attackers likely used an automated scanning tool to find vulnerable sites. The cost of entry is low. The return on investment is high, especially when targeting crypto wallets. In my 2021 NFT floor price forensics, I traced wash trading to a single governance wallet. Here, I see a similar pattern: a network of compromised sites acting as a single, decentralized attack surface.
Contrarian: What the Bulls Got Right
A defender might argue that this attack is not a crypto problem—it is a general cybersecurity problem. The malware works on any Windows machine, and the recovery phrase theft is just a byproduct of credential theft. The bulls would say that the crypto industry is not responsible for users’ actions, and that hardware wallets and multi-signature setups mitigate this risk. They are partially correct. Hardware wallets, if used correctly, would prevent the recovery phrase from being stored on the computer. The attack would be mitigated.
But the bulls miss the point: the crypto industry has done a poor job of educating users about the dangers of recovery phrase exposure. The average user does not understand that their 12-word seed is the ultimate key. They treat it like a password. The attack exploits this ignorance. The industry’s narrative of “not your keys, not your coins” is true, but it also places an enormous burden on the user. Most people are not operational security experts. The system is designed to be self-custodial, but that self-custody is fragile.
Furthermore, the attack reveals a systemic risk: the reliance on centralized infrastructure (WordPress) for decentralized coins. The attack chain is a reminder that the internet is a fragile web. The crypto ecosystem sits on top of the same vulnerable infrastructure as the rest of the web. The bulls’ optimism about user adoption ignores the fact that mass adoption requires mass security, which is not yet here.
Takeaway: The Accountability Call
If you are reading this and you have ever stored a recovery phrase in a text file, an email draft, or a screenshot, you are at risk. The StopAndProtect campaign is not an anomaly—it is a template. The attack code will be reused, modified, and deployed again. The infrastructure is cheap. The target is rich.
My advice: use a hardware wallet for any significant amount of crypto. Never enter your recovery phrase into any website, even if it looks legitimate. If a website asks you to run a command in PowerShell, close the tab. The blockchain records the transaction, but the human memory is the weakest database. Verify. Then trust. Never assume.
Forensics do not sleep. Neither should you.