Compromised WordPress sites have been used by a global operation, using trusted websites to deliver malware, instruct infected devices, and even store stolen documents.