According to CoinMeta, as reported by Decrypt, Check Point Research discovered that a ransomware known as StopAndProtect was using nearly 2,000 hacked WordPress websites to spread malware and steal cryptocurrency wallet seed phrases. As of July 24th, this attack had penetrated over 6,000 unique IP addresses, including 1,852 in the United States, 630 each in Russia and India. The attackers induced users to execute PowerShell commands through fraudulent captcha, collecting more than 31,000 screenshots and over 700 data compression packages.