OptinMonster supply chain attack hits 1.2 million sites

Sansec discovered an active supply-chain attack hitting over 1.2 million sites that use the popular OptinMonster, TrustPulse and PushEngage Wordpress plugins, all operated by Wordpress giant Awesome Motive.

Attackers added malicious JavaScript to the legitimate files served by Awesome Motive, which are embedded in their customer's sites.

The malware waits for a logged-in administrator, creates a backdoor admin account, and installs a self-hiding backdoor plugin. It then sends the new credentials to tidio.cc, a lookalike of the real tidio.com. The campaign is ongoing as of 13 June 2026.

The OptinMonster plugin alone has over a million active WordPress installations, and TrustPulse and PushEngage add many more. The payload only fires for logged-in admins, not for ordinary visitors. But as the threat actor effectively gains full control of individual sites, further abuse of regular visitors is to be expected.

Meanwhile, OptinMonster customers are complaining about a service outage.

Awesome Motive runs one of the largest WordPress plugin portfolios in the world, used across tens of millions of sites. Other products include WPForms (over 6 million active installs), MonsterInsights (around 2 million) and All in One SEO (around 3 million). So far we have only confirmed a breach of OptinMonster, TrustPulse and PushEngage code, but anyone running an Awesome Motive plugin should stay alert, watch the indicators below, and patch as the company responds.

Supply chain jackpot

The malicious code was pushed to 1m+ Wordpress sites via Awesome Motive's CDN endpoints. Any WordPress site loading one of these scripts pulled the tampered file directly from the source:

This resembles the Polyfill supply chain attack that Sansec discovered in 2024: tamper with a single upstream file, and the malware reaches thousands of downstream sites without ever touching them individually.

What the injected JavaScript does

The payload is heavily gated and runs in stages:

1. It exits immediately on navigator.webdriver, headless browsers, or a zero-size window. It only proceeds if it detects a WordPress admin context: a wp-admin path, the admin bar, or a wordpress_logged_in_ cookie. A 24-hour throttle stored in localStorage['_pe_ts'] keeps it from running repeatedly.
2. It locates the WordPress root and admin path, fingerprints the WordPress version, and harvests REST and AJAX nonces (wpApiSettings.nonce, admin-ajax.php?action=rest-nonce, and scraped from user-new.php).
3. It creates an administrator using four fallback methods in sequence: the user-new.php form, admin-ajax.php, the REST endpoint wp/v2/users, and finally a hidden iframe form submit. It even recognises "user already exists" responses in roughly twenty languages. It plants a fixed account, developer_api1 / customer1usx@gmail.com, plus randomised dev_xxxxxx accounts.
4. It silently uploads a self-hiding PHP plugin.
5. The new admin user:password, site origin, logout URL, admin path, method, timing and WordPress version are XOR-encrypted (key jX9kM2nP4qR6sT8v), base64-encoded, and sent to tidio.cc/cdn-cgi/*. Delivery falls back through sendBeacon, then fetch (no-cors), then XHR, then an Image().src beacon.

The self-hiding backdoor plugin

The plugin that gets installed is built to disappear. It hides itself from the user list, the plugin list (both the admin screen and the REST /wp/v2/plugins endpoint), update checks, and the "recently active" list. On init, with no authentication required, it exposes two entry points:

• ?developer_api1_fm opens a web shell branded "WPM File Manager & Shell", which runs system($_POST['cmd']) and accepts file uploads.
• A POST to developer_api1_eval runs eval(base64_decode(...)) on attacker-supplied input.

The operator rotates the plugin's disguise while keeping the logic byte-identical across renames. We have observed it shipping as "Content Delivery Helper" (content-delivery-helper, v2.7.1) and, currently, as "Database Optimizer" (database-optimizer, v2.9.4). The plugin ZIP is generated fresh on each request: the script fetches tidio.cc/cdn-cgi/{pe-,}l?t=gen&u=developer_api1, which returns a base64 blob that decodes through the same XOR key into the plugin id, slug and ZIP.

Active exploitation

Our friends at Patchstack quickly created detection rules and reported blocking 271 rogue-admin attempts across 13 sites on 14 and 15 June, confirming actual abuse of compromised Wordpress sites is happening. Almost all (263) hit the REST endpoint wp/v2/users, with the rest split across user-new.php and admin-ajax.php, matching the fallback order in the payload. 267 used the randomised dev_xxxxxx identity and 4 used the fixed developer_api1 account, across 81 unique IPs.

Root cause

The malware was distributed via Awesome Motive-operated domains on the BunnyNet CDN. We have not independently verified how the attacker got in, but the company has published its own account.

In its incident notices, Awesome Motive stated that the attacker exploited a known vulnerability in the UpdraftPlus WordPress plugin to reach the server hosting its marketing website, found a CDN API key stored on that server, and used it to tamper with the SDK files served to customers. The company also stated that after detecting the tampering, it reverted the affected files, purged the CDN cache, rotated the compromised key and related credentials, and migrated the marketing site to new infrastructure.

Timeline (all times in UTC)

• 2026-04-28: tidio.cc registered and a TLS certificate issued. C2 resolves to 84.201.6.54 (Ultahost, AS214036). No observed activity yet.
• 2026-06-12 22:17: first verified malware in OptinMonster and TrustPulse code via a.* domains in our intel.
• 2026-06-12 22:42: malware still present on OptinMonster and TrustPulse
• 2026-06-13 13:28: Sansec publishes this advisory.
• 2026-06-13 19:02: the OptinMonster and TrustPulse paths are clean, but the PushEngage SDK is still serving the injected code from certain CDN edges. The C2 remains live and is generating fresh payloads.
• 2026-06-14 08:44: PushEngage no longer serving the injected code.
• 2026-06-15 00:25: Awesome Motive publishes incident notices for OptinMonster and TrustPulse and PushEngage, confirming the breach and root cause.

Am I affected?

If you have one of these plugins installed and an admin logged in during the injection window, the damage is already done.

• Look for developer_api1 (customer1usx@gmail.com) and any unexpected dev_xxxxxx accounts. Remove them.
• Search the filesystem under wp-content/plugins, not just the admin screen, for content-delivery-helper / "Content Delivery Helper" and database-optimizer / "Database Optimizer". The plugin actively hides from the dashboard, so trust the disk over the UI.

If you find any indicators of compromise: rotate every admin password and secret, and assume the attacker has had unauthenticated code execution. Because the payload only ever ran for logged-in admins, server-side scanning is one of the most reliable ways to catch it.

You can run eComscan on your server to detect the backdoor plugin and rogue admin accounts, plus other malware, backdoors and vulnerabilities that may already be on your site.

Indicators of compromise

# C2
tidio.cc                                    84.201.6.54   Ultahost AS214036   reg/cert 2026-04-28
tidio.cc/cdn-cgi/p                          exfil (OptinMonster / TrustPulse variant)
tidio.cc/cdn-cgi/b
tidio.cc/cdn-cgi/l                          payload generation
tidio.cc/cdn-cgi/pe-p                       exfil (PushEngage variant)
tidio.cc/cdn-cgi/pe-b
tidio.cc/cdn-cgi/pe-l                       payload generation

# Unique strings
jX9kM2nP4qR6sT8v                            XOR key used by the malware
WPM File Manager & Shell                    backdoor shell UI

# Rogue accounts
developer_api1 / customer1usx@gmail.com     fixed operator account
dev_xxxxxx / dev_xxxxxx@gmail.com           randomised accounts

# Backdoor plugin disguises (rotating)
content-delivery-helper                     "Content Delivery Helper"   v2.7.1
database-optimizer                          "Database Optimizer"        v2.9.4

Read more

• Magento vendor Fishpig hacked, backdoors added
• Magento Developers Impersonated in Targeted GitHub Malware Operation
• Backdoor found in popular ecommerce components
• Found defunct.dat on your site? You've got a problem.
• Polyfill supply chain attack hits 100K+ sites