CDN Supply-Chain Attack Injects Malicious Code Into Three WordPress Plugins
Summary
A stolen Awesome Motive CDN API key let attackers briefly serve malware to affected WordPress sites. The code could steal administrator tokens, create rogue accounts and install backdoors; the company says its production systems and account data were not breached.
Key points
- Awesome Motive said attackers accessed a marketing server by exploiting a known UpdraftPlus flaw and stole credentials for its CDN; the company said the server was separate from production systems.
- Attackers used the stolen CDN API key to alter JavaScript distributed for OptinMonster, TrustPulse and PushEngage.
- Sansec observed malicious scripts served to OptinMonster and TrustPulse users briefly on Friday and to PushEngage users until Saturday; Awesome Motive did not confirm PushEngage impact.
- The malware activated when a WordPress administrator visited an affected page, allowing it to collect authentication tokens and nonces and create a rogue administrator account.
- A hidden backdoor plugin could provide remote access, including a web shell and arbitrary PHP code execution. Sansec saw it disguised as “Content Delivery Helper” and “Database Optimizer.”
- Awesome Motive said it removed the malicious scripts, migrated the marketing site and rotated credentials. It advised site owners to check for rogue accounts and hidden plugins, scan servers, and rotate credentials.
- The company said its application servers, source code and account-information systems were not breached and that it had no evidence account data or personal details were accessed.
Article Details
- Victim Organization
- Awesome Motive
- Incident Type
- Supply-chain attack involving a compromised CDN account and malicious JavaScript distributed through affected WordPress plugins.
- Data Types Exposed
- WordPress administrator authentication tokens and nonces; the article reports that the malicious code collected them but does not quantify collection.
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- Malicious JavaScript was served through OptinMonster, TrustPulse, and PushEngage during a limited period. The code could create rogue administrator accounts, install hidden backdoors, and enable remote access to affected websites. Awesome Motive said its application servers, source code, and systems holding OptinMonster and TrustPulse account information were not breached, and that it had no evidence account data or personal details held by the company were accessed.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
MITRE ATT&CK
T1059.007 · JavaScriptMalicious JavaScript was served to users and executed when a WordPress administrator visited an infected page.T1078 · Valid AccountsAttackers used a stolen CDN API key to access the CDN account and modify distributed JavaScript.T1136.001 · Local AccountThe malicious code could create rogue administrator accounts on affected websites.T1195.002 · Compromise Software Supply ChainAttackers used Awesome Motive's compromised CDN account to modify JavaScript distributed to users of affected plugins.T1505.003 · Web ShellAttackers installed a hidden backdoor plugin that included web-shell and remote-access capabilities.
Vendors
Products
OptinMonsterA supply-chain attack against Awesome Motive’s CDN compromised WordPress plugins OptinMonster, TrustPulse, and PushEngage, briefly serving malicious JavaScript to users.PushEngageA supply-chain attack against Awesome Motive’s CDN compromised WordPress plugins OptinMonster, TrustPulse, and PushEngage, briefly serving malicious JavaScript to users.TrustPulseA supply-chain attack against Awesome Motive’s CDN compromised WordPress plugins OptinMonster, TrustPulse, and PushEngage, briefly serving malicious JavaScript to users.UpdraftPlus#OptinMonsterWordPressA supply-chain attack against Awesome Motive’s CDN compromised WordPress plugins OptinMonster, TrustPulse, and PushEngage, briefly serving malicious JavaScript to users.