This active supply-chain attack targeted over 1.2 million WordPress sites using OptinMonster, TrustPulse, and PushEngage plugins by injecting malicious JavaScript into files served through Awesome Motive's CDN endpoints. The malware activates upon administrator login, creating backdoor admin accounts (including developer_api1 and randomized dev_xxxxxx accounts) and installing a self-hiding PHP plugin. This backdoor provides unauthenticated remote code execution via a web shell and eval endpoint. Credentials stolen from compromised sites are sent to tidio.cc, a domain mimicking the legitimate tidio.com. The initial compromise likely stemmed from Awesome Motive's servers or their BunnyNet CDN account. The attack campaign lasted from late April through mid-June 2026, impacting over one million OptinMonster installations and users of TrustPulse and PushEngage plugins.

The attack compromises site integrity by injecting malicious code into widely used WordPress plugins, enabling attackers to create hidden administrative accounts and execute arbitrary code without authentication. This allows persistent unauthorized access and control over affected sites. Additionally, stolen credentials are exfiltrated to a malicious domain, increasing the risk of further compromise. The scale of the attack, affecting over 1.2 million sites, amplifies its potential impact on the WordPress ecosystem and site administrators.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Site administrators should verify the integrity of their plugin files, remove any unauthorized admin accounts (such as developer_api1 and dev_xxxxxx accounts), and scan for self-hiding PHP plugins. It is critical to change all credentials potentially exposed and monitor for suspicious activity. Since the breach likely originated from compromised Awesome Motive servers or their CDN account, users should follow official communications from Awesome Motive for updates and patches. Until official fixes are confirmed, consider disabling affected plugins or restoring sites from clean backups.