---
title: "Hackers turned thousands of abandoned WordPress sites into a botnet for spreading spyware"
description: "Check Point Research experts uncovered a botnet made up of thousands of abandoned WordPress sites through which attackers spread spyware, a ransomware, and network worms."
date: 2026-08-24T11:20:03.000Z
lang: en
url: https://xab.info/en/posts/hackers-turned-thousands-of-abandoned-wordpress-sites-into-a-botnet
tags: [wordpress, botnet, cyberattack, ransomware, clickfix, cybersecurity]
publisher: "XAB.info"
---

# Hackers turned thousands of abandoned WordPress sites into a botnet for spreading spyware

![WordPress admin dashboard on a laptop: hackers turn abandoned sites into a botnet to spread spyware](https://xab.info/media/2026/08/24/hakeri-prevratili-zabroshennye-sayty-wordpress-v-botnet/hakeri-prevratili-zabroshennye-sayty-wordpress-v-botnet-1.webp)

## 🎯 Key Points

- Hackers use abandoned WordPress sites with outdated CMS and plugins as botnet infrastructure instead of buying their own servers
- The attack is built on the ClickFix scheme: a fake CAPTCHA window convinces the victim to run a PowerShell command
- The SilentEncryptor ransomware, network worms, and the SilentDataCollector spyware module were loaded onto victims' computers
- The investigation became possible due to the hackers' OPSEC mistakes: one operator accidentally infected their own work PC
- WordPress accounts for about 43% of the global website market, making it the main target; users must never run commands from CAPTCHA checks

Cybercriminals have stopped buying their own command servers and moved to a cheaper and less conspicuous infrastructure: they take over abandoned web resources running outdated versions of content management systems and obsolete plugins. This is reported by RBC-Ukraine, citing a report by cybersecurity experts at Check Point Research. According to the researchers, some of the infected resources had up to 40 unpatched vulnerabilities, which made such sites an ideal quiet staging ground for attacks.

### How the attack scheme works

The attackers embedded malicious code into the compromised sites that showed visitors a fake CAPTCHA verification window using the popular ClickFix social engineering scheme. Users were convinced that they were not a robot and were asked to copy and run a command line in the PowerShell console for verification. It was precisely this step that triggered the chain of malware downloads onto the victim's computer, bypassing some of the standard protective mechanisms.

### What was loaded onto the victims' computers

After the command was executed, a whole set of viruses was installed on the PC: from the SilentEncryptor ransomware and network worms to the SilentDataCollector spyware module. The broken WordPress sites were used repeatedly — for storing stolen data, dumping logs, and as command servers controlling the botnet.

### How the investigation became possible

According to the report, the botnet was uncovered due to gross operational security (OPSEC) mistakes by the creators of the infrastructure themselves. In particular, one of the operators of the hacker group accidentally infected their own work computer with the spyware module. As a result, the virus automatically collected and uploaded data to the developers' server, including information about other victims, which gave researchers the key to exposing the entire scheme.

### Why WordPress is the main target

The WordPress platform accounts for about 43 percent of the entire global website market, which makes it a priority target for such attacks. A significant portion of resources is eventually abandoned by their owners but remains online with old versions of the core and plugins that no longer receive security updates.

### Recommendations for website owners and users

Experts advise website owners to immediately update the WordPress engine itself, as well as all installed plugins and themes, or to remove those that are no longer supported by their developers. It is important for ordinary users to remember a simple rule: no CAPTCHA verification ever requires copying commands and running them in the Windows or PowerShell console. You should immediately leave such sites and not perform the proposed actions.

## 🔍 Fact-Check Verification

- [Large-scale hacker attack: 2,000 WordPress sites turned into a botnet](https://www.rbc.ua/ukr/news/masshtabna-hakerska-ataka-2000-saytiv-wordpress-1787563783.html) - Первичный источник, передающий отчёт Check Point Research: схема ClickFix, PowerShell, набор вирусов (SilentEncryptor, SilentDataCollector), OPSEC-ошибки хакеров, доля WordPress ~43%.
- [Botnet](https://www.tadviser.ru/index.php/%D0%A1%D1%82%D0%B0%D1%82%D1%8C%D1%8F:%D0%91%D0%BE%D1%82%D0%BD%D0%B5%D1%82_(Botnet)) - Справочный источник по определению и устройству ботнета; не противоречит фактам основной новости, использован для контекста.

## ❓ FAQ

### Q: What is ClickFix and how does the attack work in it?
**A:** ClickFix is a social engineering scheme in which the victim is persuaded to perform a malicious action. In the described attack, visitors were shown a fake CAPTCHA verification window and asked to copy and run a command line in the PowerShell console, which triggered the download of viruses.

### Q: Which specific malicious programs were loaded onto the victims' computers?
**A:** According to the Check Point Research report, the SilentEncryptor ransomware, network worms, and the SilentDataCollector spyware module were loaded onto the PCs.

### Q: Why did the hackers choose abandoned WordPress sites?
**A:** Such resources with old CMS versions and outdated plugins (in some cases with dozens of unpatched vulnerabilities) allowed them to host malicious code for free and inconspicuously and to use the sites as command servers and storage for stolen data. WordPress accounts for about 43% of the global website market.

### Q: What should an ordinary user do when a CAPTCHA check asks them to run a command?
**A:** No genuine CAPTCHA verification requires copying and running commands in the Windows or PowerShell console. You should immediately leave such sites and not perform the proposed actions.