OptinMonster supply chain attack hits 1.2 million sites

Sansec discovered an active supply-chain attack hitting over 1.2 million sites that use the popular OptinMonster, TrustPulse and PushEngage Wordpress plugins, all operated by Wordpress giant Awesome Motive.

Attackers added malicious JavaScript to the legitimate files served by Awesome Motive, which are embedded in their customer's sites.

The malware waits for a logged-in administrator, creates a backdoor admin account, and installs a self-hiding backdoor plugin. It then sends the new credentials to tidio.cc, a lookalike of the real tidio.com. The campaign is ongoing as of 13 June 2026.

The OptinMonster plugin alone has over a million active WordPress installations, and TrustPulse and PushEngage add many more. The payload only fires for logged-in admins, not for ordinary visitors. But as the threat actor effectively gains full control of individual sites, further abuse of regular visitors is to be expected.

Meanwhile, OptinMonster customers are complaining about a service outage:

Awesome Motive runs one of the largest WordPress plugin portfolios in the world, used across tens of millions of sites. Other products include WPForms (over 6 million active installs), MonsterInsights (around 2 million) and All in One SEO (around 3 million). So far we have only confirmed a breach of OptinMonster, TrustPulse and PushEngage code, but anyone running an Awesome Motive plugin should stay alert, watch the indicators below, and patch as the company responds.

Supply chain jackpot

The malicious code did not live on any victim's own server but was injected via Awesome Motive's CDN endpoints. Any WordPress site loading one of these scripts pulled the tampered file directly from the source:

This resembles the Polyfill supply chain attack that Sansec discovered in 2024: tamper with a single upstream file, and the malware reaches thousands of downstream sites without ever touching them individually.

What the injected JavaScript does

The payload is heavily gated and runs in stages:

1. It exits immediately on navigator.webdriver, headless browsers, or a zero-size window. It only proceeds if it detects a WordPress admin context: a wp-admin path, the admin bar, or a wordpress_logged_in_ cookie. A 24-hour throttle stored in localStorage['_pe_ts'] keeps it from running repeatedly.
2. It locates the WordPress root and admin path, fingerprints the WordPress version, and harvests REST and AJAX nonces (wpApiSettings.nonce, admin-ajax.php?action=rest-nonce, and scraped from user-new.php).
3. It creates an administrator using four fallback methods in sequence: the user-new.php form, admin-ajax.php, the REST endpoint wp/v2/users, and finally a hidden iframe form submit. It even recognises "user already exists" responses in roughly twenty languages. It plants a fixed account, developer_api1 / customer1usx@gmail.com, plus randomised dev_xxxxxx accounts.
4. It silently uploads a self-hiding PHP plugin.
5. The new admin user:password, site origin, logout URL, admin path, method, timing and WordPress version are XOR-encrypted (key jX9kM2nP4qR6sT8v), base64-encoded, and sent to tidio.cc/cdn-cgi/*. Delivery falls back through sendBeacon, then fetch (no-cors), then XHR, then an Image().src beacon.

The self-hiding backdoor plugin

The plugin that gets installed is built to disappear. It hides itself from the user list, the plugin list (both the admin screen and the REST /wp/v2/plugins endpoint), update checks, and the "recently active" list. On init, with no authentication required, it exposes two entry points:

• ?developer_api1_fm opens a web shell branded "WPM File Manager & Shell", which runs system($_POST['cmd']) and accepts file uploads.
• A POST to developer_api1_eval runs eval(base64_decode(...)) on attacker-supplied input.

The operator rotates the plugin's disguise while keeping the logic byte-identical across renames. We have observed it shipping as "Content Delivery Helper" (content-delivery-helper, v2.7.1) and, currently, as "Database Optimizer" (database-optimizer, v2.9.4). The plugin ZIP is generated fresh on each request: the script fetches tidio.cc/cdn-cgi/{pe-,}l?t=gen&u=developer_api1, which returns a base64 blob that decodes through the same XOR key into the plugin id, slug and ZIP.

Root cause

The malware was distributed via Awesome Motive-operated domains via the BunnyNet CDN. It is unknown which got hacked: Awesome Motive's own servers (likely), their CDN account (possible) or BunnyNet (unlikely). The fact that the malware for two of the three plugins quickly disappeared, suggest that they were aware of the breach. We have reached out to Awesome Motive but not received a response yet.

Timeline

• 2026-04-28: tidio.cc registered and a TLS certificate issued. C2 resolves to 84.201.6.54 (Ultahost, AS214036). No observed activity yet.
• 2026-06-12 22:17 UTC: first verified malware in OptinMonster and TrustPulse code via a.* domains in our intel.
• 2026-06-12 22:42 UTC: last verified malware on OptinMonster and TrustPulse
• 2026-06-13 19:02 UTC: the OptinMonster and TrustPulse paths are clean, but the PushEngage SDK is still serving the injected code from certain CDN edges. The C2 remains live and is generating fresh payloads.

Am I affected?

If you have one of these plugins installed and an admin logged in during the injection window, the damage is already done. Sorry.

• Look for developer_api1 (customer1usx@gmail.com) and any unexpected dev_xxxxxx accounts. Remove them.
• Search the filesystem under wp-content/plugins, not just the admin screen, for content-delivery-helper / "Content Delivery Helper" and database-optimizer / "Database Optimizer". The plugin actively hides from the dashboard, so trust the disk over the UI.

If you find any indicators of compromise: rotate every admin password and secret, and assume the attacker has had unauthenticated code execution. Because the payload only ever ran for logged-in admins, server-side scanning is one of the most reliable ways to catch it.

You can run eComscan on your server to detect the backdoor plugin and rogue admin accounts, plus other malware, backdoors and vulnerabilities that may already be on your site.

Indicators of compromise

# C2
tidio.cc                                    84.201.6.54   Ultahost AS214036   reg/cert 2026-04-28
tidio.cc/cdn-cgi/p                          exfil (OptinMonster / TrustPulse variant)
tidio.cc/cdn-cgi/b
tidio.cc/cdn-cgi/l                          payload generation
tidio.cc/cdn-cgi/pe-p                       exfil (PushEngage variant)
tidio.cc/cdn-cgi/pe-b
tidio.cc/cdn-cgi/pe-l                       payload generation

# Unique strings
jX9kM2nP4qR6sT8v                            XOR key used by the malware
WPM File Manager & Shell                    backdoor shell UI

# Rogue accounts
developer_api1 / customer1usx@gmail.com     fixed operator account
dev_xxxxxx / dev_xxxxxx@gmail.com           randomised accounts

# Backdoor plugin disguises (rotating)
content-delivery-helper                     "Content Delivery Helper"   v2.7.1
database-optimizer                          "Database Optimizer"        v2.9.4

Read more

• Magento vendor Fishpig hacked, backdoors added
• Magento Developers Impersonated in Targeted GitHub Malware Operation
• Backdoor found in popular ecommerce components
• Found defunct.dat on your site? You've got a problem.
• Polyfill supply chain attack hits 100K+ sites