I didn't think a fake CAPTCHA could steal my crypto. But here we are: 2000 compromised WordPress sites, 6000+ infected IPs, 31,000 screenshots of desktop activities, and 700+ compressed archives of stolen data. This isn't just ransomware. It's a surgical extraction of wallet recovery phrases, executed by a campaign that treats your browser trust like a doormat.
Let me cut through the noise. The StopAndProtect attack, uncovered by Check Point Research, is a masterclass in supply chain exploitation. The attackers didn't break into high-security vaults. They hacked WordPress websites—your neighborhood blog, your small business portal, maybe even a site you've visited for a quick tutorial. Once inside, they weaponized the site's own traffic. A visitor lands on the page, sees a fake CAPTCHA, and is instructed to press Windows Key + R, paste a PowerShell command, and hit Enter. That's it. One moment you're solving a puzzle, the next your machine is a zombie.
Context: The Infrastructure of Deception
WordPress powers 40% of the web. That's a massive attack surface. The attackers exploited this by infiltrating sites through known plugin vulnerabilities—no zero-days needed, just lazy admin practices. Once they owned the site, they injected a script that redirects users to a fake CAPTCHA page. The CAPTCHA is a social engineering masterpiece: it looks exactly like the real thing, but the 'verify' button triggers a download of a malicious PowerShell script. The script then executes a chain of commands: it steals browser cookies, session tokens, and most critically, scans for any file containing the word 'recovery' or 'seed' in your downloads, documents, or desktop. It also takes screenshots of your screen every 30 seconds, capturing your wallet browser extensions, your password manager, your private messages.
But the attack doesn't stop at theft. The malware also propagates through network shares and USB drives. It deploys a ransomware component called 'StopAndProtect' that encrypts your files and demands a ransom. The twist? Even if you pay, the attackers already have your recovery phrase. They don't just ransom your files; they ransom your entire crypto portfolio.
Core: The Mechanics of Extraction
I've seen plenty of MEV bots and front-running scripts in my time. But this is different. The attackers built a distributed system of C2 servers, each hosted on a different compromised WordPress site. They used the same infrastructure to host malware, store stolen data, and send commands. The sheer scale—31,000 screenshots, 700+ ZIP archives—indicates automated harvesting. The attackers likely run scripts that parse the screenshots with OCR to extract wallet addresses and recovery phrases, then check balances on-chain. Any wallet with a non-zero balance gets drained instantly.
Now, let's talk about the technical elegance. The PowerShell script is obfuscated, but not sophisticated. It uses Base64 encoding and a few layers of string manipulation. The real innovation is the delivery mechanism. By using a fake CAPTCHA, the attackers bypass traditional antivirus and browser security because the user is voluntarily executing the command. It's a classic social engineering pivot, but executed with a level of operational maturity that suggests a professional group.
Based on my own experience running a MEV bot in 2020, I can tell you that automating extraction is trivial once you have access to the data. The hard part is getting the data. The attackers have solved that. They've created a pipeline from compromised WordPress → malicious CAPTCHA → PowerShell execution → data exfiltration → crypto drain. It's a pipeline that works at scale.
Contrarian: The Real Vulnerability Isn't Your Computer
Everyone says 'use a hardware wallet.' I agree. But here's the contrarian take: even a hardware wallet is useless if you type your recovery phrase into a compromised computer. The attack doesn't need to hack your Ledger or Trezor. It needs you to have a digital copy of your seed phrase—a text file, a screenshot, a note in your password manager. That's what it steals.
The blockchain doesn't care about your security posture. Once the coins are moved to an attacker-controlled address, they're gone. No multisig, no recovery key, no DAO rescue. The blockchain is a machine of finality. The only way to protect yourself is to never, ever expose your recovery phrase to any digital device. Not your phone, not your laptop, not your cloud storage. Write it on paper, store it in a fireproof safe, and never type it anywhere.
Another blind spot: the WordPress ecosystem. The attack is a wake-up call for site owners. If you run a WordPress site, you are now a potential vector for crypto theft. The attackers aren't targeting you; they're targeting your visitors. Your site's integrity is your responsibility. Update your plugins. Remove unused themes. Enable two-factor authentication. And for god's sake, don't use 'admin' as your username.
Takeaway: The Signal in the Noise
I don't know who's behind StopAndProtect. But I know the playbook will be copied. The fake CAPTCHA + PowerShell combo is too effective. Expect to see variants targeting macOS with AppleScript, or Linux with bash. The next wave might not even use WordPress—it could be a compromised npm package or a malicious browser extension.
Here's what you do: - Never run a command from a website. If a site asks you to press Windows Key + R and paste something, close the tab immediately. - Use a hardware wallet, but never type your recovery phrase on any computer. If you must restore a wallet, do it on a dedicated, air-gapped machine. - Enable browser extensions that block scripts and CAPTCHAs from unknown sources. - For WordPress admins: audit your site now. If you see unexpected files in wp-content/uploads, or if your site has been compromised, reset all passwords and revoke API keys.
The market is in a bull run. Hopium is high. But the floor is made of sand. A single malicious PowerShell command can wipe out your entire portfolio. The blockchain doesn't lie, but it doesn't protect you from yourself. Stay sharp.