Awesome Motive CDN served backdoor JavaScript to 1.2M sites

Sansec reported on June 13, 2026 that attackers had tampered with JavaScript served from Awesome Motive's content delivery network, reaching more than 1.2 million WordPress sites running the company's OptinMonster, TrustPulse, and PushEngage plugins. The plugin code on those sites was never modified. The files they load at runtime were.

Awesome Motive is one of the larger WordPress plugin businesses, and the three affected products all work by embedding a vendor-hosted script into the customer's pages, for popups, social-proof notifications, and web push. That design means a single CDN object is trusted by every installation. Sansec said malicious scripts were served to OptinMonster and TrustPulse users on Friday, June 12, between 22:17 UTC and 22:42 UTC, and described the campaign as ongoing at the time of publication.

The payload waited for a logged-in administrator. Sansec said it located the WordPress root and admin path, fingerprinted the WordPress version, and harvested REST and AJAX nonces from the live session. It then created backdoor administrator accounts, both a fixed one named developer_api1 using the address customer1usx@gmail.com and randomized accounts of the form dev_xxxxxx, and installed a plugin that hides itself from the WordPress admin screens, appearing on disk under names such as "Content Delivery Helper" or "Database Optimizer." Credentials went to tidio.cc, a lookalike for the legitimate customer-messaging vendor tidio.com.

Awesome Motive said the attacker had exploited a known vulnerability in the UpdraftPlus plugin to reach the server hosting its marketing website, found a CDN API key stored there, and used that key to alter the SDK files served to customers. The company reverted the affected files, purged the CDN cache, rotated the compromised key and related credentials, and moved the marketing site to new infrastructure. Because the backdoor hides from the dashboard, site owners were told to audit their administrator accounts and look for the extra plugin directories on disk rather than trusting the plugin list.