Attackers Hijack Popular WordPress Plugins to Deploy Backdoors

Attackers hijacked JavaScript delivered by Awesome Motive for OptinMonster, TrustPulse and PushEngage, injecting dormant payloads that, when a site administrator loads a page, create new admin accounts, install a stealth backdoor plugin, and send credentials to a lookalike tidio.cc domain; OptinMonster alone runs on over a million sites, raising widespread supply-chain risk. Sansec observed the tampered scripts during short exposure windows (about half an hour for some plugins) and urged admins to check for unfamiliar admin accounts and traffic to tidio.cc.