Compromised Infrastructure Abuse

Check Point finds 2,000 hacked WordPress sites doing the hosting for a crypto-stealing toolkit

The StopAndProtect campaign keeps its payloads, command channel and stolen-file storage on other people's blogs. That makes domain reputation a weaker signal, and cleanup somebody else's bill.