Check Point finds 2,000 hacked WordPress sites doing the hosting for a crypto-stealing toolkit

Renting hosting costs money and leaves a billing trail. A neglected WordPress blog costs nothing and arrives with a domain that has been resolving normally for years. According to Check Point researcher Jaromir Horejsi, every layer of the operation sat on that borrowed ground: the payload, the redirect instructions sent to infected machines, and the storage for exfiltrated files ^[4]. A single compromised site can do all three jobs at once ^[5].

The yield per domain is thin. Around 6,000 infected IP addresses spread across nearly 2,000 hosting domains is about three victims per site ^[1], and the United States share of those infections is under a third ^[3]. The domains are not being picked for their traffic. They are being picked because they are free and because they are believed.

What turns 2,000 unrelated victims into one asset is the tooling. Check Point recovered source code for an automation utility written in Visual Basic 6 that switches the fake CAPTCHA page on and off, redirects visitors and pushes malware updates across the hacked sites, with the domain list sitting in an attached text file ^[13]. That is fleet management. Pulling one node out of it does not cost the operator a server, because there was never a server to seize.

Cleaning a site is also not the end of it. When the researchers examined the WordPress instance behind one of the malicious domains, they counted close to 40 separate vulnerabilities, some dating back to 2021 ^[8]. Sites in that state are re-enrollable, which is the practical reason a takedown list ages badly.

The data volume argues against reading this purely as a wallet drainer. Check Point collected more than 31,000 screenshots from victim machines between mid-May and the end of July ^[11], roughly 400 a day ^[2], plus over 700 archives of documents, passwords and wallet files ^[10]. Newer builds log keystrokes and capture the screen every 30 seconds ^[7]. Horejsi describes not one piece of malware but a toolkit, including a component that works as a live chat between attacker and victim ^[20]. All of that upstream visibility exists because the operators left directories and logs open, and because they appear to have infected one of their own machines ^[12][14].

One gap in the report matters for anyone reading this as a Windows problem. Check Point does not say whether macOS or Linux users are affected ^[16], and the same ClickFix pattern has been aimed at Macs elsewhere this year: Jamf Threat Labs traced a sponsored ad on X in July to a Terminal command that installed a variant of the Atomic infostealer ^[17], and Microsoft warned in August about fake CAPTCHAs served from compromised sites and BNB Chain smart contracts ^[18].

Which leaves the one control that does not depend on the domain being honest. Decrypt's advice is to leave any page that prompts you to paste or type something ^[15]. As Security Affairs puts it, a hacked website is no longer just a hacked website ^[19], and its owner is unlikely to know the difference.