6,000+ SYSTEMS HIT: THE WORDPRESS TRAP HIDING BEHIND A “CAPTCHA”

How hackers turned legitimate websites into cybercrime infrastructure and why Nigerian website owners should pay attention

You visit a website.

A CAPTCHA appears.

“Verify you are human.”

Nothing unusual, right?

Except this time, the CAPTCHA doesn't ask you to identify traffic lights or click a checkbox.

It tells you to copy something, open a system tool and paste it.

You follow the instructions.

And congratulations...

You may have just installed the malware yourself.

This is the idea behind StopAndProtect, a large-scale cybercrime operation that has compromised thousands of WordPress websites and turned them into infrastructure for malware delivery, command-and-control, surveillance and stolen-data storage.

Nigeria's Computer Emergency Response Team (ngCERT) has issued an advisory warning organizations and website administrators about the operation. More than 6,000 unique IP addresses have been identified in the campaign, while researchers uncovered files referencing nearly 2,000 compromised WordPress domains. (Nigerian Certificate Authority)

And here's the part website owners need to understand:

The hacked website isn't always the final target.

Sometimes...

YOU are.

THE WEBSITE YOU TRUST MAY BE THE TRAP

One reason this campaign is so effective is simple:

The website may look completely legitimate.

It could be:

• A business website

• A blog

• An online store

• A news website

• A professional service website

• A small company's WordPress site

The attackers compromise the website first.

Then they use it as a platform to attack the visitors.

Researchers found that compromised WordPress sites were being repurposed for multiple stages of the operation including delivering malware, relaying commands and storing stolen information. (Check Point Blog)

This creates a dangerous trust problem.

The victim thinks:

“I'm visiting a legitimate website.”

But the website has already been compromised.

The trusted website has become the weapon.

THE FAKE CAPTCHA TRAP

This is where ClickFix comes in.

The victim encounters a fake CAPTCHA or verification page.

It looks like something designed to prove you're human.

But instead of completing the verification inside the browser, the instructions attempt to persuade the user to perform actions outside the browser.

That's the red flag.

A legitimate CAPTCHA does not need you to open PowerShell, Command Prompt, Terminal or another system utility and execute commands.

The New Zealand National Cyber Security Centre recently issued its own warning about compromised websites serving these fake CAPTCHA/ClickFix pages. (NCSC NZ)

Remember this rule:

If “Verify you are human” asks you to run a command, close the page.

HOW THE ATTACK CAN UNFOLD

The frightening thing about StopAndProtect is that the fake CAPTCHA is only the beginning.

The broader infection chain can involve multiple stages.

1️⃣ COMPROMISED WEBSITE

Attackers gain control of a vulnerable WordPress installation.

2️⃣ FAKE CAPTCHA

A malicious plugin or injected code presents a deceptive verification page.

3️⃣ SOCIAL ENGINEERING

The victim is convinced to perform an action that a normal CAPTCHA would never require.

4️⃣ MALWARE DELIVERY

The resulting command can trigger PowerShell and additional downloaders/loaders.

5️⃣ PAYLOAD DEPLOYMENT

Multiple malicious components can then be introduced.

6️⃣ DATA THEFT / SURVEILLANCE / RANSOMWARE

Depending on the victim and objective, attackers can steal information, monitor activity, move laterally or deploy ransomware.

Researchers identified components associated with file theft, credential theft, screenshots, network propagation and ransomware capabilities. (The Hacker News)

One fake CAPTCHA can therefore become the front door to a much larger compromise.

THE CLEVER PART: THE HACKED WEBSITES BECOME THE INFRASTRUCTURE

This is arguably the most interesting part of the operation.

Instead of depending entirely on a small collection of obvious attacker-controlled servers, the criminals abused other people's websites.

Thousands of compromised WordPress installations effectively became pieces of a distributed criminal network.

Some were used to:

DELIVER MALWARE

↓

COMMUNICATE WITH INFECTED MACHINES

↓

STORE STOLEN INFORMATION

↓

MANAGE THE OPERATION

↓

SUPPORT FURTHER COMPROMISES

Check Point researchers described the operation as turning poorly maintained WordPress sites into distributed infrastructure for malware delivery, surveillance, data theft and ransomware. (Check Point Blog)

That's a major shift in how we should think about website compromise.

Your website doesn't have to be valuable to the attacker.

It can be valuable because your infrastructure is useful.

THE WORDPRESS PROBLEM

WordPress itself isn't the villain here.

The problem is the enormous ecosystem around it.

Websites often contain:

• WordPress core

• Themes

• Plugins

• Page builders

• Forms

• Analytics tools

• Payment integrations

• Third-party scripts

Every additional component can potentially become another attack surface.

Researchers investigating StopAndProtect found compromised sites running severely outdated WordPress installations, including one dating back to 2021 with numerous known vulnerabilities. (SIT-CyberSecurity)

And that's exactly what attackers want.

An unmaintained website can become a permanent foothold.

WHY NIGERIAN WEBSITE OWNERS SHOULD CARE

This is where the story becomes much closer to home.

Nigeria has thousands of businesses, organizations, schools, media platforms, churches, NGOs, startups and individuals running WordPress websites.

Many are managed by:

One person.

Sometimes that person is:

• The business owner

• The developer

• The administrator

• The person paying for hosting

• The person handling backups

And sometimes...

Nobody is actually monitoring the website.

That creates an uncomfortable question:

Do you actually know what your WordPress website is doing right now?

You may know that the homepage works.

You may know that customers can contact you.

You may know that your blog is online.

But that doesn't necessarily mean the website hasn't been compromised.

A hacked WordPress site can continue looking normal while quietly serving malicious content to selected visitors.

THE cPANEL CONNECTION

For many small businesses, WordPress and cPanel live together.

That's convenient.

But it also means website security cannot stop at:

“I installed WordPress.”

You need to think about the entire environment:

WordPress

•  Plugins
•  Themes
•  PHP
•  Database
•  cPanel
•  Hosting account
•  FTP/SFTP
•  Email accounts
•  DNS
•  Backups
•  Admin credentials

If an attacker obtains sufficient access, the website can become a launchpad for attacks against visitors or other systems.

HOW DO YOU KNOW YOUR WEBSITE HAS BEEN COMPROMISED?

Watch for unusual behaviour.

🚩 RED FLAG 1: Unexpected CAPTCHA pages

Visitors suddenly report strange verification screens.

🚩 RED FLAG 2: Your website displays different content to different people

Attackers may selectively show malicious pages based on operating system, browser or other characteristics.

🚩 RED FLAG 3: Unknown WordPress plugins

Especially plugins you never installed.

🚩 RED FLAG 4: Strange files

Unexpected PHP files or recently modified files deserve investigation.

🚩 RED FLAG 5: Unknown administrator accounts

Check your WordPress users.

🚩 RED FLAG 6: Unexpected outbound traffic

Your website suddenly communicating with unfamiliar infrastructure is worth investigating.

🚩 RED FLAG 7: Security warnings from visitors

Never dismiss multiple visitor complaints simply because your own browser looks normal.

WHAT WEBSITE OWNERS SHOULD DO NOW

1️⃣ UPDATE WORDPRESS

Keep WordPress core updated.

But don't stop there.

2️⃣ UPDATE EVERY PLUGIN AND THEME

Outdated plugins are a common route into poorly maintained WordPress installations.

Remove plugins you don't actually need.

If you don't use it, delete it.

3️⃣ USE MULTI-FACTOR AUTHENTICATION

Protect:

• WordPress administrator accounts

• Hosting accounts

• cPanel

• Email

• Domain registrar

• Cloud services

One stolen password shouldn't be enough to compromise everything.

4️⃣ AUDIT ADMINISTRATOR ACCOUNTS

Look for:

• Unknown users

• Old developer accounts

• Former employee accounts

• Suspicious privilege changes

Remove anything that shouldn't exist.

5️⃣ CHECK YOUR FILES

If you suspect compromise, don't simply delete the visible fake CAPTCHA.

Investigate the underlying compromise.

The New Zealand NCSC specifically warns that removing only the visible ClickFix page isn't enough; website owners need to identify the original compromise and eliminate persistence mechanisms. (NCSC NZ)

6️⃣ CHECK YOUR LOGS

Review:

• Login activity

• File changes

• Plugin installations

• Administrative actions

• Unusual requests

• Outbound connections

Your logs can tell a story your homepage won't.

7️⃣ MAINTAIN OFFLINE OR ISOLATED BACKUPS

Backups are useless if attackers can modify or delete them too.

Maintain protected backup copies that aren't permanently exposed to the same environment.

8️⃣ PUT SECURITY MONITORING IN PLACE

Website owners shouldn't discover a compromise because a customer says:

“Your website is showing something strange.”

You want your security controls to tell you first.

AND IF YOU ARE THE VISITOR?

This may be even simpler.

NEVER FOLLOW THESE INSTRUCTIONS:

“Press Windows + R.”

“Open PowerShell.”

“Open Command Prompt.”

“Paste this code.”

“Run this command to verify you're human.”

STOP.

Close the website.

A real CAPTCHA doesn't require you to execute a command on your computer.

THE PSYCHOLOGY BEHIND CLICKFIX

The attackers aren't necessarily trying to defeat your antivirus.

They're trying to defeat you.

That's why the technique is so interesting.

Instead of:

Malware → computer

the attack becomes:

Trust → deception → user action → malware

The user becomes part of the execution chain.

And that's incredibly powerful.

THIS IS WHY “JUST DON'T CLICK SUSPICIOUS LINKS” IS NO LONGER ENOUGH

The website may not look suspicious.

The domain may have a good reputation.

The page may have HTTPS.

The design may look professional.

The CAPTCHA may look convincing.

Everything can look normal.

Until the website asks you to do something that normal websites don't ask you to do.

That's the moment you should stop.

THE BIGGER CYBERSECURITY LESSON

StopAndProtect demonstrates something important about modern cybercrime:

Attackers don't always need to build their own infrastructure.

Sometimes...

They borrow yours.

Your website.

Your server.

Your cloud account.

Your employee's laptop.

Your credentials.

Your customer's trust.

That's why cybersecurity is increasingly becoming a battle over trust and infrastructure, not simply passwords and antivirus software.

OSMALLAMINTECH TAKE

For years, many website owners treated security as:

“The website is online, therefore it's fine.”

That's no longer enough.

A website can be online...

and compromised.

It can look normal...

and be serving malware.

It can have a valid SSL certificate...

and still be dangerous.

And it can be a small business website with almost no traffic...

yet still be valuable to cybercriminals.

The StopAndProtect operation is a warning that every neglected WordPress installation can potentially become someone else's cyber weapon.

And for Nigerian businesses running WordPress, this should be a wake-up call.

Update your site. Audit your site. Monitor your site.

Because the next person who visits it might not be a customer.

They might be the target.

OSMALLAMINTECH QUESTION

If a website you trust suddenly showed a CAPTCHA telling you to open PowerShell and paste a command, would you know it was a cyberattack?

YES — I'd close the site immediately.

or

NO — I might actually follow the instructions.

Be honest.

Have you ever seen a “Verify you're human” page that asked you to do something outside the browser? 

OSMALLAMINTECH

Cybersecurity Awareness | Threat Intelligence | Digital Resilience

This is a strong one for the new style. The next infographic can be built around the visual hook “THE CAPTCHA IS THE TRAP” rather than simply repeating the article, giving us another distinctive design instead of the AI-hacker aesthetic.