As many as 1.2 million sites pulled malicious code from a trusted vendor's delivery network after attackers tampered with JavaScript used by popular WordPress plugins, Dutch malware researcher Sansec reported on June 13.
OptinMonster, TrustPulse and PushEngage: the immediate victims
Sansec identified the injection in the JavaScript served for OptinMonster, TrustPulse and PushEngage — three plugins published by WordPress vendor Awesome Motive. Because the altered files were delivered from the vendor's own network, any site loading those scripts received the tampered files directly from the source rather than hosting the malicious payload locally.
Sansec said the payload remains dormant until a logged-in administrator loads a page, leaving ordinary visitors untouched for the moment. That design limits immediate visibility of the compromise but allows the attacker to target high-value accounts on individual sites.
Tampered script behavior: rogue admin accounts, a stealth backdoor and credential exfiltration
According to Sansec's analysis, once a logged-in administrator is detected the malicious script creates a new administrator account on the compromised site, installs a self-hiding backdoor plugin to retain access, and then transmits the new credentials to a lookalike of the legitimate chat service tidio.com. Sansec specifically warned site operators to watch for unfamiliar administrator accounts and for traffic to tidio[.]cc as an indicator of compromise.
OptinMonster alone runs on more than one million sites; TrustPulse and PushEngage account for additional installs. Sansec warned that because the attacker effectively gains control of each compromised site, abuse of regular visitors is likely to follow.
Delivery network compromise and uncertain entry points
The malicious code was served through Awesome Motive's delivery network rather than being planted directly on victim servers. Sansec noted three possible entry points for the attackers: Awesome Motive's own servers, its CDN account, or, less likely, the BunnyNet network used behind the scenes. The firm did not identify which of those was definitively exploited.
Sansec's telemetry shows a short, observable window for some of the tampered files: the OptinMonster and TrustPulse code were logged serving malicious content for about half an hour late on June 12 before the altered files disappeared, suggesting the vendor may have detected and removed the changes. The PushEngage script was still serving malware on June 13, per Sansec's report.
Awesome Motive's reach and the potential scale of impact
While only the three plugins above are confirmed compromised, Awesome Motive's portfolio extends much further. Sansec cited additional products with very large install counts: WPForms with more than six million installs, All in One SEO on around three million sites, and MonsterInsights on roughly two million sites. None of those plugins is a confirmed hit in this campaign, but their presence underscores the potential breadth of impact if the underlying delivery infrastructure were abused.
Sansec likened the campaign to the 2024 Polyfill attack, in which a single poisoned upstream file affected thousands of downstream sites — a comparison intended to highlight how a single compromised source can cascade across a large portion of the web.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: Sansec urged operators running Awesome Motive plugins to monitor for unfamiliar administrator accounts and for outbound traffic to tidio[.]cc, and to act quickly if either indicator appears.
- Procurement and platform owners: The incident illustrates how a vendor with a wide install base can increase downstream risk; the vendor's footprint (tens of millions of sites, per Sansec's description) is a relevant factor when assessing supply-chain exposure.
- End users and site visitors: While ordinary visitors were reportedly untouched "for now," Sansec warned that abuse of regular visitors is likely to follow once an attacker controls a site, making compromised site detection and remediation time-critical.
Sansec's report raises a central unanswered operational question: which specific part of the vendor delivery chain was breached — Awesome Motive's servers, its CDN account, or BunnyNet — and how quickly was the issue contained across the vendor's ecosystem? Infosecurity has reached out to Awesome Motive for comment.
https://www.infosecurity-magazine.com/news/wordpress-plugin-supply-chain/
