A sophisticated supply-chain attack targeting the WordPress plugins OptinMonster, TrustPulse, and PushEngage has exposed more than 1.2 million websites to potential compromise after malicious JavaScript was injected into files distributed through official CDN infrastructure. The malware, which activated only when a logged-in WordPress administrator visited an affected site, created hidden administrator accounts and installed stealthy backdoors capable of granting attackers full remote control.
Attack Vector: Compromised CDN API Key Enabled Mass Distribution of Malicious Code
The campaign was discovered by security firm Sansec, which reported on June 13 that malicious code was being served through CDN-hosted JavaScript files relied upon by all three plugins. Rather than compromising individual websites directly, the attackers exploited trusted plugin resources to reach a vast number of WordPress installations simultaneously.
OptinMonster and TrustPulse owner Awesome Motive confirmed the incident, attributing the breach to the compromise of a CDN API key. According to the company’s investigation, attackers exploited a known vulnerability in a third-party plugin called UpdraftPlus running on a marketing website server. After gaining access to that server, the attackers located credentials for the company’s CDN account and used them to modify JavaScript files served to customer websites. Importantly, Awesome Motive stated that its application servers, source code repositories, and customer account data systems were hosted separately and show no evidence of unauthorized access.
Technical Analysis: How the Malware Operated
Sansec’s analysis revealed that the injected JavaScript executed only when a logged-in WordPress administrator visited an affected website. Once activated, the malware performed three primary actions: it gathered WordPress security tokens, attempted to create administrator accounts, and installed a hidden plugin that provided attackers with persistent remote access.
Hidden Administrator Accounts and Credential Harvesting
Researchers observed the malware creating a fixed administrator account named developer_api1 linked to [email protected], alongside randomized dev_xxxxxx administrator accounts. Site information and stolen credentials were then transmitted to the attacker-controlled domain tidio.cc, a lookalike of the legitimate customer support platform Tidio.
Stealth Backdoor Plugin Design
The installed backdoor plugin was engineered to evade detection by hiding from WordPress plugin listings, user interfaces, update checks, and API responses. Sansec identified two disguises used during the campaign: Content Delivery Helper and Database Optimizer. The plugin also exposed unauthenticated web shell and code execution functionality, effectively granting attackers unrestricted control of compromised sites.
Timeline and Exposure Window
The first malicious activity was observed on June 12, with infected code removed from OptinMonster and TrustPulse resources shortly afterward. Sansec reported that some PushEngage CDN nodes continued serving the malicious payload until June 14. Awesome Motive described the exposure window as lasting only a few hours on June 12, although the company continues to verify the exact timeline using CDN logs.
Remediation and Response
Awesome Motive reports that it has revoked and rotated the compromised CDN credentials, remediated and migrated the affected marketing server, purged malicious files from the CDN, and launched a broader security review.
How to Check If Your Site Is Compromised
Website administrators running the affected plugins should immediately check for unauthorized accounts such as developer_api1 or unexpected dev_xxxxxx users. They should also inspect the wp-content/plugins directory for hidden plugins named content-delivery-helper or database-optimizer.
What Affected Users Should Do Now
If any indicators of compromise are found, administrators should immediately remove the backdoor plugin, rotate all passwords, API keys, database credentials, and WordPress security keys. Assume that attackers obtained full administrative access to the site and act accordingly — this means auditing all user accounts, reviewing recent changes to site files and database entries, and monitoring for unusual activity. Even if no signs of compromise are detected, enabling multi-factor authentication for all administrator accounts and implementing a robust, regularly updated backup strategy are prudent measures. For ongoing protection, consider deploying a reputable security plugin that includes file integrity monitoring, firewall rules, and real-time threat detection to catch similar supply-chain attacks early in the future.
