The data is stark: 1,982 compromised WordPress domains, 6,000+ unique victim IPs, and over 31,000 screenshots captured from unsuspecting users. This is not a protocol exploit or a smart contract bug. It is a human-targeted attack chain that turns the most trusted element of crypto security—the recovery phrase—into a liability. Ledgers do not lie, only the narrative does. And the narrative here is that the weakest link in DeFi is still the user's desktop.
Context: The Attack Anatomy
Since May 2025, a threat actor known only as “StopAndProtect” has been running a sophisticated campaign that weaponizes WordPress websites as a global command-and-control infrastructure. The modus operandi is deceptively simple: visitors to a compromised site are greeted with a fake CAPTCHA prompt. Instead of verifying humanity, the prompt instructs Windows users to open PowerShell and paste a base64-encoded command. That single command downloads a multi-stage malware loader that exfiltrates browser cookies, credentials, and—most critically—cryptocurrency wallet recovery phrases from locally stored files. The same payload also deploys a ransomware component that encrypts documents and demands a crypto payment.
Based on my audit experience of over 200 DeFi protocols, I have seen countless smart contract vulnerabilities. But this attack is different—it does not exploit code; it exploits trust in visual interfaces. The fake CAPTCHA is a social engineering artifact that bypasses all technical defenses because the user voluntarily executes the malicious payload. The attackers have automated the entire lifecycle: compromise a WordPress site via outdated plugins, inject the malicious script, collect exfiltrated data in centralized storage servers, and then use the stolen recovery phrases to sweep wallet balances.
Core: The On-Chain Evidence Chain
Check Point Research, which tracked the campaign, documented over 31,000 unique screenshots stolen from victims. These screenshots are not random—they are deliberately captured from the desktop at moments when the wallet is open or when the recovery phrase is being typed. The attackers also collected 700+ compressed archives from infected machines, suggesting they are not only targeting crypto wallets but also any sensitive documents that could be leveraged for further extortion.
What makes this attack particularly dangerous for crypto holders is the irreversibility of the theft. Once a recovery phrase is captured, the attacker can generate the private keys offline, move funds to a fresh address, and then use a mixer or a privacy coin to obfuscate the trail. On-chain forensics can trace the flow, but the probability of recovery is near zero. The data shows that the average amount stolen per wallet is not disclosed, but given the scale of the compromise, the cumulative loss likely runs into the millions of dollars.
I have analyzed similar phishing campaigns in the past, but the scale here is unprecedented. The attackers do not need to exploit a zero-day vulnerability. They simply need a WordPress site with a vulnerable plugin—and there are hundreds of thousands of those. The campaign has been active since May, and as of late July, new infections were still being detected. This is not a one-off event; it is a sustained operation.
Contrarian Angle: Correlation Is Not Causation
Many in the security community will blame WordPress—and to some extent, they are right. WordPress powers over 40% of the web, and its plugin ecosystem is a constant source of vulnerabilities. However, the real vulnerability is not the CMS itself; it is the user's willingness to paste a command into PowerShell based on a visual prompt. The attack succeeds because humans have been conditioned to trust CAPTCHAs as a legitimate security measure. The attackers are exploiting a behavioral pattern, not a technical flaw.
Moreover, the crypto industry often focuses on protocol-level security—audits, formal verification, bug bounties—while ignoring the endpoint. A DeFi protocol can be mathematically sound, but if the user's machine is infected, the entire security model collapses. Survival is the ultimate alpha in a bear market, and in a bull market, euphoria masks technical flaws. Right now, the market is euphoric, and users are distracted by price action. They are not updating their WordPress plugins or questioning the legitimacy of a CAPTCHA.
Another counter-intuitive observation: the attackers are inadvertently helping security researchers. By collecting so many screenshots and compressed files, they have created a massive dataset for forensic analysis. The researchers were able to identify the attacker's own infrastructure because the malware inadvertently infected some of the attacker's test machines. This is a classic case of attackers being too aggressive in their own deployment.
Takeaway: The Next-Week Signal
The StopAndProtect campaign is a textbook example of how the intersection of legacy web vulnerabilities and crypto asset theft creates a new class of risk. The next evolution will likely target macOS and Linux users, or use more sophisticated lures such as fake browser update prompts. The on-chain signal to watch is a sudden spike in small-value transfers from dormant wallets to fresh addresses, which could indicate a mass sweep of stolen recovery phrases. Trust the math, ignore the hype—and never, ever paste a command into a terminal window that you did not personally write.
As I tell my clients: the strongest smart contract is worthless if the private key is typed into a compromised browser. Audit your own security habits before you audit a protocol.