StopAndProtect ClickFix operation

Summary

Check Point Research published this analysis on 18 August 2026, naming the operation StopAndProtect after the ransomware family it first noticed in mid-May. The infrastructure is other people's websites: hacked WordPress installations — close to 2,000 named in the operators' own file lists — carry the lure, serve every stage, relay commands, and hold what is taken. A Windows visitor to one of them meets a counterfeit CAPTCHA that puts a PowerShell command on the clipboard. Two PowerShell stages and two .NET stages later comes a toolkit: a file encryptor, an SMB and USB worm, a screen locker, a VBS spreader, a stealer of files and credentials, and a chat window between operator and victim. Exposed directory listings let Check Point parse logs holding more than 6,000 unique IP addresses by late July, most in the US, Russia, and India, some of them sandboxes rather than victims.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 44 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

Both of these mechanisms appear together in 9 of the 44 campaigns on record, this one included. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

39 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.