Awesome Motive WordPress Plugin Supply-Chain Attack (OptinMonster, TrustPulse, PushEngage) Delivering Self-Hiding Backdoor via Poisoned CDN JavaScript — Threadlinqs Intelligence
As of 2026-06-15, Awesome Motive WordPress Plugin Supply-Chain Attack (OptinMonster, TrustPulse, PushEngage) Delivering Self-Hiding Backdoor via Poisoned CDN JavaScript is a critical-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-0801 · Severity: CRITICAL · CVSS: 8.1 · Status: ACTIVE · Category: SUPPLY_CHAIN
Attackers injected malicious JavaScript into legitimate CDN-served scripts for Awesome Motive's OptinMonster, TrustPulse, and PushEngage WordPress plugins. The code activated only in logged-in
Between 2026-06-12 and 2026-06-14, security firm Sansec identified an active software supply-chain compromise affecting roughly 1.2 million WordPress sites that embed CDN-hosted JavaScript from Awesome Motive's OptinMonster (1M+ installs), TrustPulse, and PushEngage (9,000+ installs) plugins. Rather than compromising each victim site, the attackers tampered with the legitimate scripts served from Awesome Motive's own CDN endpoints (a.omappapi.com, a.opmnstr.com, a.optnmstr.com, a.trstplse.com, and clientcdn.pushengage.com), so the malicious code was delivered downstream to every embedding site.
The injected payload was heavily gated to evade analysis and limit noise. It exited immediately on navigator.webdriver, headless browsers, or zero-size windows, and only proceeded when it detected a WordPress administrator context (a wp-admin path, the admin bar, or the wordpress_logged_in_ cookie). It enforced a 24-hour throttle per browser via localStorage key _pe_ts to avoid repeated execution. Once gated through, the script fingerprinted the WordPress version, located the site root and admin paths, and harvested REST/AJAX nonces from multiple sources (wpApiSettings.nonce, admin-ajax.php?action=rest-nonce, and the user-new.php page) to authenticate privileged actions in the admin's session.
Using the stolen nonces, the payload created a backdoor administrator account through four fallback methods: the user-new.php form, admin-ajax.php, the REST endpoint wp/v2/users, and a hidden iframe form submission. It recognized 'user already exists' responses across roughly twenty languages to remain idempotent. A fixed account developer_api1 (customer1usx@gmail.com) and randomized dev_xxxxxx accounts were used. It then uploaded and activated a self-hiding PHP backdoor plugin disguised as 'Content Delivery Helper' (slug content-delivery-helper, v2.7.1) or 'Database Optimizer' (slug database-optimizer, v2.9.4). The plugin actively hid itself from the admin plugin list, the wp/v2/plugins REST endpoint, update checks, and activity logs. It exposed two unauthenticated entry points: a web shell reached via the ?developer_api1_fm parameter ('WPM File Manager & Shell' interface) that runs system commands from $_POST['cmd'], and a code-execution endpoint developer_api1_eval that eval()s base64-decoded attacker payloads. Harvested credentials were XOR-encrypted with the hardcoded key jX9kM2nP4qR6sT8v, base64-encoded, and exfiltrated to tidio[.]cc (a typosquat of the legitimate tidio.com) over several fallback transports, hitting paths /cdn-cgi/p, /cdn-cgi/b, /cdn-cgi/l for the OptinMonster/TrustPulse variant and /cdn-cgi/pe-p, /cdn-cgi/pe-b, /cdn-cgi/pe-l for the PushEngage variant.
The C2 domain tidio[.]cc resolved to 84.201.6.54 (Ultahost, AS214036) and was registered on 2026-04-28 with a TLS certificate issued the same day, indicating roughly six weeks of pre-staging. PushEngage attributed initial access to a known flaw in UpdraftPlus on its marketing server, referencing CVE-2026-10795 (an UpdraftPlus UpdraftCentral udrpc unauthenticated authentication bypass, CWE-347, CVSS 8.1) that allows forged RPC commands to run as the connected administrator and can lead to plugin upload and RCE. Sansec was unconvinced by that single explanation and assessed that Awesome Motive's own build/CDN infrastructure was the more likely tamper point. Exposure windows were narrow for OptinMonster/TrustPulse (~22:17-22:42 UTC on 2026-06-12) but lasted several hours for PushEngage, with injected code still observed on some CDN servers on 2026-06-13 and removed by 2026-06-14.
Weaknesses (CWE)
CWE-347, CWE-506, CWE-912, CWE-94
Target sectors: technology, e-commerce, media, small-business, marketing, hosting
Target regions: Global, North America, Europe
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, CVE-2026-10795, T1583, T1584, T1587, T1195, T1189, T1190, T1059, T1505, T1136, T1505