StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data

Cybersecurity researchers have flagged a global cybercrime operation that abuses thousands of hacked WordPress websites as infrastructure to disseminate malware, commandeer infected hosts, store stolen documents, screenshots, and activity logs created to track the status of the activity. "The operation doesn't rely on a single piece of malware, but on a whole toolkit of criminal software

Reportedly, attackers are running a global cybercrime operation that abuses nearly 2,000 compromised WordPress sites to distribute malware, control infected hosts, and store stolen documents, screenshots, and activity logs. The operation is said to use a toolkit of different criminal software rather than a single malware family. From a RealGround perspective, while the article does not explicitly mention AI, such large-scale, modular infrastructure could be leveraged to host, distribute, or command AI-enabled malware and data-exfiltration pipelines. Organizations using AI systems should assume this type of infrastructure can be used to stage data theft or model-targeting attacks and should implement continuous red teaming and CISO-led oversight to monitor and harden AI-related assets against compromise.