Hook
Nearly 2000 compromised WordPress sites. 31,000 screenshots. 700 compressed files. All targeting one thing: your cryptocurrency wallet recovery phrase.
The data suggests that the 'StopAndProtect' ransomware campaign, active since May 2024, is not just another malware outbreak. It is a meticulously engineered extraction pipeline. The attack chain begins with a fake CAPTCHA prompt and ends with complete control of a user's digital assets.
Contrary to the prevailing narrative that DeFi hacks are the primary threat, the real vulnerability is often the user's own machine. Tracing the recovery phrase exfiltration back to the PowerShell command reveals a systemic failure in endpoint security within the crypto ecosystem.
Context
On August 21, 2024, Check Point Research published a detailed analysis of a large-scale ransomware campaign they call 'StopAndProtect'. The attack leverages compromised WordPress websites as the initial infection vector. According to their telemetry, over 6,000 unique IP addresses have been targeted, with victims primarily in the United States, Russia, and India. The campaign remains active as of July 24, 2024.
The attackers did not just deploy ransomware. They built a multi-stage operation: infection via fake CAPTCHA, credential theft, cryptocurrency wallet recovery phrase extraction, and network propagation. The infrastructure includes nearly 2,000 hijacked WordPress sites used as command-and-control (C2) servers, file storage, and malware distribution points.
Deconstructing the attack surface from WordPress to wallet, we see a classic supply chain compromise. The weak link is not the blockchain protocol—it is the content management system that hosts the user's gateway to the internet.
Core: Technical Analysis of the Attack Chain
Stage 1: WordPress Compromise
The attackers likely exploited known vulnerabilities in WordPress plugins or themes. The scale—nearly 2,000 sites—suggests automated scanning and exploitation of common flaws (e.g., outdated plugins like 'Elementor' or 'WP Super Cache'). The compromised sites are then injected with malicious JavaScript that redirects users or displays fake CAPTCHA pages.
Based on my audit experience, this is a typical attack pattern for mass-scale WordPress breaches. The attackers do not need zero-days; they rely on site administrators failing to update software. The economic incentive: compromising a site costs minimal effort (using automated exploit kits), yet the site's traffic becomes a funnel for malware delivery.
Stage 2: The Fake CAPTCHA
When a user visits a compromised site, they are presented with a fake CAPTCHA challenge. The user is instructed to complete a 'security check' by pressing a key combination (often Windows Key + R) and then pasting a command into the Run dialog. This is a social engineering masterpiece: it exploits the user's habituation to CAPTCHA prompts and their trust in the site.
The command is a PowerShell script. Here is a simplified version of what the payload does:
powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "..."The script is obfuscated, but its core functions are: - Download a secondary payload from a remote server (one of the compromised WordPress sites). - Establish persistence via registry run keys or scheduled tasks. - Exfiltrate data: screenshots, browser credentials, and specifically cryptocurrency wallet files and recovery phrases. - Propagate to other devices on the same network via SMB exploits or removable USB drives. - Deploy the StopAndProtect ransomware to encrypt files and demand payment.
Stage 3: Data Exfiltration
The malware takes screenshots of the user's desktop at regular intervals—31,000 screenshots were collected by the attacker's servers. This is not just random surveillance; it is designed to capture moments when the user is interacting with wallet software, entering passwords, or viewing recovery phrases.
Additionally, the malware scans for files containing keywords like 'wallet', 'seed', 'phrase', 'private', 'key', 'backup', 'keystore', and file extensions commonly associated with cryptocurrency wallets (e.g., .json, .dat, .wallet). It then compresses these files into archives (over 700 compressed files were found) and uploads them to the C2 servers.
Stage 4: Recovery Phrase Extraction
The ultimate goal is the recovery phrase (seed phrase). Once obtained, the attacker can restore the wallet on any device and drain all funds. The blockchain’s immutability means these transactions cannot be reversed. The attacker has complete control without needing to compromise the smart contract.
Tracing the recovery phrase exfiltration back to the PowerShell command, we see that the attack is not technically sophisticated in terms of cryptography—it is a pure endpoint security failure. The cost to the attacker is low: they pay for exploit kits and hosting. The potential reward is high: a single recovery phrase can yield thousands of dollars. The economic incentive behind the malware is a cost-benefit analysis of user security. The attacker assumes that the majority of users will not recognize the malicious behavior and will comply with the fake CAPTCHA.
Threat Model
Let us formalize the threat model:
- Asset: User's cryptocurrency wallet private keys/recovery phrase.
- Threat Actor: Organized cybercriminal group (likely, given the scale).
- Attack Vector: Compromised WordPress site → fake CAPTCHA → social engineering → PowerShell execution.
- Vulnerability: User's lack of awareness about executing unknown commands; trust in familiar web interactions.
- Impact: Complete loss of assets.
This is a classic 'man-in-the-browser' attack, but with a twist: it uses the user's own trust in the system to bypass technical defenses. The attacker does not need to exploit a zero-day in the wallet software; they exploit the user's behavior.
Propagation and Persistence
The malware includes modules for network propagation. It scans for open SMB shares and attempts to copy itself to other machines using weak credentials (common passwords). It also monitors for USB drives and automatically copies the payload to them, using autorun.inf to trigger execution on other systems. This is a worm-like behavior that increases the attack surface exponentially.
Persistence is achieved through registry modifications. The malware creates a value under 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' to load on boot. It also schedules a task to run every hour to ensure it remains active even if the user removes the initial entry.
Ransomware Component
After data exfiltration, the malware encrypts files on the local machine and network shares. The StopAndProtect ransomware appends a custom extension and drops a ransom note demanding payment in Bitcoin. However, the primary revenue stream for the attackers is likely the stolen recovery phrases, not the ransomware payments. The ransomware is a distraction and an additional pressure tactic.
Data Analysis from Check Point
Check Point researchers set up honeypots and captured the malware's communications. They identified: - 31,000+ screenshots from victims. - 700+ compressed archives of sensitive files. - The C2 servers were the same compromised WordPress sites. - The attackers were careless: they infected their own testing systems, leading to researchers gaining access to the attackers' own infrastructure.
This is a fascinating twist. The attackers became victims of their own malware, allowing researchers to analyze the internal workings. The data suggests that the attackers are not infallible; they made basic operational security mistakes.
Contrarian Angle
The prevailing narrative in crypto security focuses on smart contract bugs, oracle manipulation, and governance attacks. The industry spends millions on auditing DeFi protocols and building secure L2 infrastructures. Yet, the most significant threat to individual users remains the security of their own devices.
Contrary to the assumption that blockchain technology is the solution, the problem is the human-machine interface. The most secure ZK-rollup with formal verification is useless if the user's private key is stored on a Windows machine that executes arbitrary PowerShell commands. The attack does not target the blockchain; it targets the user's endpoint.
This is a blind spot in the crypto security discourse. We obsess over protocol-level risks while ignoring the simple fact that the vast majority of users are not equipped to identify phishing or social engineering attacks. The security community must shift focus to user education and endpoint hardening.
Takeaway
This attack is a harbinger of a new wave of crypto-specific malware. The solution is not just better code, but better user behavior. Cold storage, hardware wallets, and never paste unknown commands. The future of crypto security depends on educating users that the chain is secure, but the machine is not.
As the industry matures, we must accept that the weakest link is the human using the keyboard. The math does not negotiate—but neither does a compromised PowerShell prompt.