At least 1.2 million websites used the OptinMonster plugin that, according to researchers, delivered malicious JavaScript via a compromised content distribution network for a brief, but dangerous, window of time.
How the CDN supply‑chain compromise unfolded
E‑commerce security firm Sansec discovered that OptinMonster, TrustPulse, and PushEngage plugins were affected after attackers modified JavaScript files served from Awesome Motive’s CDN. Sansec reports the modified scripts were served to OptinMonster and TrustPulse users on Friday between 22:17 UTC and 22:42 UTC; PushEngage continued to serve malicious JavaScript until 19:02 UTC on Saturday. The publisher says the malicious content was removed after remediation.
What the malicious code did and how it persisted
The injected malware activated only when a WordPress administrator visited a page on an infected site. At that moment, the script collected authentication tokens and nonces and used them to create a rogue administrator account. Attackers then installed a self‑hiding backdoor plugin and opened a communication channel that sent captured data to a domain impersonating Tidio.
The compromised plugin also supplied full remote access capabilities: a web shell identified as "WPM File Manager & Shell" and arbitrary PHP code execution, giving attackers complete control of affected websites. Sansec noted the operator repeatedly renamed the backdoor plugin while keeping its logic identical, observing it delivered under names such as "Content Delivery Helper" (content-delivery-helper, v2.7.1) and "Database Optimizer" (database-optimizer, v2.9.4).
UpdraftPlus flaw led to theft of the CDN API key
Awesome Motive published a security advisory saying attackers gained access to a server in its environment after exploiting a known flaw in the UpdraftPlus WordPress plugin. That server hosted a marketing website separate from the company’s production infrastructure, but it contained credentials for the company’s CDN account, which the attackers stole.
Using the stolen CDN API key, attackers modified the JavaScript files distributed via Awesome Motive’s CDN so websites silently loaded malicious code directly from those CDN locations. Awesome Motive listed the affected files as:
- a.omappapi.com/app/js/api.min.js – OptinMonster
- a.opmnstr.com/app/js/api.min.js – OptinMonster
- a.optnmstr.com/app/js/api.min.js – OptinMonster
- a.trstplse.com/app/js/api.min.js – TrustPulse
Awesome Motive’s remediation and assurances
Awesome Motive said it has remediated the marketing site, migrated it to a new server, and rotated all credentials, "including the CDN API key." The publisher also stated, "Our application servers, our source code, and the systems that store your OptinMonster and TrustPulse account information are hosted separately and were not breached," and that it has no evidence that account data or personal details held by the company were accessed.
Despite removal of the malicious CDN content, the company warned that the attacker retains access to compromised websites as long as rogue administrator accounts and hidden backdoor plugins remain present on those sites.
What this means for WordPress administrators, security teams, and Awesome Motive
WordPress administrators — site owners should assume compromise if they used OptinMonster, TrustPulse, or PushEngage during the indicated windows and verify whether rogue admin accounts or hidden plugins exist. Awesome Motive recommended checking for and removing accounts named 'developer_api1' or 'dev_xxxxxx', inspecting wp-content/plugins for hidden backdoors, running server‑side malware scans, and rotating administrator passwords, API keys, database credentials, and WordPress security salts.
Security teams and incident responders should treat CDN‑distributed script changes as a supply‑chain incident and validate CDN key usage and server credentials. Sansec’s findings about plugin rename patterns underline that attribution via filename is fragile; defenders must inspect behavior and file contents, not just names. The broader risk is illustrated by a cited statistic: security teams log 54% of successful attacks and alert on just 14% (Picus whitepaper), a reminder that breach and attack simulation can test detection and response controls.
For Awesome Motive and other vendors, the episode highlights credential hygiene: segmentation of marketing systems from CDN credentials allowed attackers to reach distribution paths without accessing production data, but storing CDN keys on an externally facing marketing server created a viable attack vector.
Practical steps for potentially affected sites
- Search the WordPress admin user list for accounts named 'developer_api1' or 'dev_xxxxxx' and remove any unauthorized entries.
- Inspect the filesystem under wp-content/plugins for plugins with misleading names such as "Content Delivery Helper" or "Database Optimizer" and for hidden backdoor code.
- Execute server‑side malware scans and look for a web shell labeled "WPM File Manager & Shell" or signs of arbitrary PHP execution hooks.
- Rotate administrator passwords, API keys (including CDN keys), database credentials, and WordPress security salts.
The immediate danger from this incident is not only the transient injection of malicious JavaScript from a trusted CDN but the persistence mechanisms installed afterward. Until site owners remove rogue accounts and hidden plugins, attackers may retain effective control — a fact Sansec and Awesome Motive both emphasize in their findings and advisories.
Original reporting: https://www.bleepingcomputer.com/news/security/optinmonster-wordpress-plugin-hacked-in-cdn-supply-chain-attack/
