OptinMonster / TrustPulse / PushEngage plugin supply chain

Sansec (13 Jun 2026): malware in OptinMonster, TrustPulse and PushEngage
WordPress plugins added admin accounts and a hidden backdoor on ~1.2
million sites. First verified malware 12 Jun via a.* domains; tidio.cc
registered 28 Apr. Classic third-party web-plugin supply chain (same
class as Polyfill.io AS8).

Mapped techniques

T0205 Compromise third-party CDN or hosted web asset
T0121 Compromised legitimate artifact
T0134 Add user

supply-chain plugin origin compromise

T0205 · Initial Access · Compromise third-party CDN or hosted web asset

Widely embedded marketing plugins pushed malware to 1.2M sites.

T0121 · Resource Development · Compromised legitimate artifact

OptinMonster, TrustPulse, PushEngage.

T0134 · Persistence · Add user

Malware added admin accounts plus a hidden backdoor.

Sources

https://sansec.io/research/optinmonster-supply-chain-attack