CDN credentials unleash a silent attack that exposed hundreds of thousands of WordPress sites

An attack on the supply chain that took advantage of the CD credentials of Awesome Motive compromised the scripts distributed by the WordPress OptinMonster, TrustPulse and, at least partially, PushEngage plugins, exposing hundreds of thousands of sites to a silent intrusion and directed to web administrators.

According to the public analysis carried out by the Sansec firm, the attackers modified JavaScript files served from supplier subdomains - on routes such as / app / js / api.min.js- to run malicious code on the pages that loaded those resources; OptinMonster, the most widespread solution of the trio, has more than a million facilities and therefore concentrates the greatest risk of mass impact. The technical report is available here: Sansec report.

The initial vector was not a failure in OptinMonster but the exploitation of a known vulnerability in the UpdatPlus plugin on a marketing server of Awesome Motive which, although separate from the production infrastructure, stored CDN credentials. With that key the attackers altered the distributed scripts, an illustration of how the loss of an apparently peripheral credential can trigger a chain engagement.

The campaign was designed to be activated only when a WordPress administrator visited the website: the JavaScript captured authentication and nonces tokens, used them to create forged administrator accounts, installed a backdoor plugin that was hidden with changing names and deployed a shell web that allowed arbitrary PHP execution and total remote control of the site. Awesome Motive published his own communication on the incident, which should be reviewed: statement by Awesome Motive.

The scenario is of concern for several reasons: first, the invasion occurred without touching the supplier's code repository or production servers, which complicates the detection; second, the activation conditioned to the access of an administrator allows to remain latent to obtain valuable credentials; and third, the technique of renaming the malicious plugin while maintaining the logic intact makes it difficult to detect based on signatures or file names.

If you manage a WordPress using any of these plugins you must make commitment and act urgently: search and remove unknown administrative accounts (Sansec and Awesome Motive have identified example names used by attackers), manually inspect the content of wp-content / plugins to detect folders or hidden files with unusual or changing names, and run malware scans from the server. For practical guides to CMS hardening and good practices, see official documentation: WordPress Hardening Guide.

It is also essential to rotate all potentially compromised credentials: management account passwords, API keys (especially CDN), database credentials and WordPress jumps. If you have the capacity, restores from a backup prior to the date of the incident and compares hashes and user lists to the current installation; do not delete any trace without first making a forensic copy if you need to investigate scope and vectors.

At the organizational level, security providers and agencies should review the principle of minimum privilege: sensitive credentials should not be stored in less harsh marketing environments or servers; segregation of functions, automatic key rotation and access audit reduce the likelihood that a single failure will result in a large-scale commitment.

For site owners who have already cleaned the malicious loads, attention: the mere removal of the altered script in the CDN does not guarantee security as long as there are illegal administrative accounts or hidden backdoor plugins that allow to reestablish access. It is necessary to audit programmed tasks, check PHP file integrity and monitor outgoing connections to suspicious domains used to exfilter data.

Finally, this incident reinforces a key lesson in cybersecurity in complex ecosystems: supply chains and shared services such as CDNs are risk concentration points that require technical controls (MFA, key rotation, immutable logs), operational (quick response procedures) and contractual (security requirements to suppliers) to minimize the scope when something fails.