Hook
2000 WordPress sites. 6000+ IPs. 31,000 screenshots. 700+ compressed files of stolen data. This isn't a DeFi exploit. It's a supply chain infection targeting your recovery phrase. The attack is still live. If you've seen a CAPTCHA asking you to run a PowerShell command in the last three months, your wallet might already be drained.
Context
Check Point Research dropped the report on StopAndProtect ransomware. But the real story isn't the ransomware itself—it's the delivery mechanism. Attackers compromised nearly 2000 WordPress sites, using them as command-and-control nodes, malware hosts, and data storage. The infection chain is deceptively simple: a fake CAPTCHA page prompts Windows users to copy a PowerShell command and paste it into their terminal. That command downloads a multi-stage malware that steals credentials, takes screenshots, and specifically targets cryptocurrency wallet recovery phrases. Once inside, it spreads across the network and via USB drives. The campaign started in May 2024 and was still active as of July 24.
Most victims are in the US, Russia, and India. But the attackers could be anywhere. The infrastructure is decentralized: each compromised WordPress site can serve malware, send commands, or store stolen data. This makes takedown difficult.
Core
Let's break down why this attack works so well. It's not about zero-day vulnerabilities. It's about human psychology and the default trust we place in familiar interfaces.
The fake CAPTCHA is brilliant in its simplicity. Every user knows the drill: "I'm not a robot." But here, the CAPTCHA is a script that generates a meaningless text string. The page then instructs the user to press Win+R, type "powershell", hit Enter, and paste the copied text. The user is doing the work of infection. No drive-by download. No exploit. Just a user executing a malicious command because they think they're verifying their humanity.
From my quant trading days, I've seen how execution speed can be an edge. But here, speed is the enemy. The faster you paste that command, the faster you lose your assets.
We didn't expect the attack vector to be a CAPTCHA. But after years of battle, I've learned that the most dangerous attacks are the ones that mimic normal behavior. In 2020, I spent hours auditing Uniswap V2 contracts for reentrancy. That was code-level. This is user-level. The weakest link is the human operating system.
The malware itself is a multi-stage loader. Stage 1 is a PowerShell script that downloads and executes a second-stage payload. Researchers found that the malware captures screenshots of the victim's desktop—31,000 of them. That's not random. Attackers are likely using optical character recognition to scan for wallet interfaces, exchange pages, and recovery phrase entries. They're monitoring your activity in real time.
They also compress stolen data into zip files. Over 700 of them. Each zip likely contains credentials, browser cookies, and crypto wallet files. The recovery phrase theft is automated via string matching. The attackers are probably scanning for common phrase words or wallet-specific patterns. Then they hit the blockchain.
What makes this attack particularly insidious is the persistence. The malware isn't just a one-and-done. It spreads via network shares and USB drives. If you're in an office environment, one infected machine can compromise the entire firm.
Contrarian
The common narrative is that hardware wallets are the ultimate solution. But that's a half-truth. Hardware wallets are secure only if you never enter your recovery phrase on a compromised device. The moment you type that 12-word phrase into a website or a desktop wallet—even if you're just "recovering" your wallet—you're at risk. This attack targets that exact moment.
Retail thinks they're safe because they don't download shady files. But the attack vector is a CAPTCHA—something you see daily. Smart money knows that the real risk is when you trust your own machine. The attack chain doesn't rely on user stupidity. It exploits a gap in human intuition: "I've done this before, it's fine."
Another blind spot: security researchers and auditors focus on smart contract bugs. But the biggest losses in 2024 haven't been from DeFi exploits. They've been from social engineering and key theft. This attack is a perfect example. It's not a protocol vulnerability. It's a supply chain attack that uses the WordPress ecosystem as a carrier.
Liquidity isn't just about market depth. It's about the flow of keys from your screen to the chain. When that flow is compromised, so is your liquidity. The attackers aren't targeting exchanges or protocols. They're targeting the individual. And they're doing it at scale.
Takeaway
Your recovery phrase is a nuclear code. Never type it into any system that isn't air-gapped. If you see a CAPTCHA asking you to run a PowerShell command, close the tab. In the chaos of the sprint, speed wasn't my edge—it was the bull. But here, hesitation is the only safe move. How many of your friends have entered their phrase on a website?