Awesome Motive CDN Breach Hits 1.2 Million Sites Running OptinMonster  🔗 **Source:** [Awesome Motive CDN Breach Hits 1.2 Million Sites Running OptinMonster](https://www.therepository.email/awesome-motive-cdn-breach-hits-1-2-million-sites-running-optinmonster) 📄 **Full text:** ![[Full Document Contents/Articles/Awesome Motive CDN Breach Hits 1.2 Million Sites Running OptinMonster.md|Awesome Motive CDN Breach Hits 1.2 Million Sites Running OptinMonster by therepository.email]] ## Highlights - Using the stolen key, the attacker modified the JavaScript files the three plugins serve to customer sites at the CDN edge, appending malicious code to the legitimate SDKs. The malware only fired when a logged-in WordPress administrator loaded an affected page. It hijacked the admin’s own authenticated session to create hidden administrator accounts and install a self-hiding backdoor plugin that gave the attacker full control of the site. ([View Highlight](https://read.readwise.io/read/01kv8ajp91307wddtkx9papj5k)) - Tags: 👻 ai highlighted - “The administrator is the victim, not the attacker,” Patchstack Security Research Lead Dave Jong wrote in his analysis. “The malicious requests carry the administrator’s legitimate session and a legitimate nonce, because the administrator’s own browser is the one making them.” ([View Highlight](https://read.readwise.io/read/01kv8acahanbef41whyvkrx018)) - Note: The admin's browser becomes the attack proxy: malicious requests carry "the administrator's legitimate session and a legitimate nonce, because the administrator's own browser is the one making them" — so nonce/session checks don't stop it. (Patchstack's Dave Jong.) - Tags: atom/literature/h1, security, wordpress - Patchstack also found that the command-and-control domain `tidio.cc`—a lookalike of the legitimate chat service tidio.com—was registered on April 28, more than six weeks before the attack. ([View Highlight](https://read.readwise.io/read/01kv8acm74ct47xzey0ve5z19q)) - Note: Premeditated: the C2 domain tidio.cc (a lookalike of the real tidio.com) was registered April 28 — six-plus weeks before the attack. Pre-staged lookalike infrastructure is a planning signal worth watching for. - Tags: security, atom/literature/h2, threat-intel - Where those earlier attacks compromised WordPress.org’s distribution pipeline, this one hit upstream for Awesome Motive. Sansec’s Forensics Team compared it to the Polyfill supply chain attack it discovered in 2024: “Tamper with a single upstream file, and the malware reaches thousands of downstream sites without ever touching them individually.” ([View Highlight](https://read.readwise.io/read/01kv8ac2w34fpzdba59fwnarha)) - Note: CDN-key theft is a supply-chain multiplier: "tamper with a single upstream file, and the malware reaches thousands of downstream sites without ever touching them individually" (Sansec, comparing to the 2024 Polyfill attack). One upstream compromise → 1.2M sites. - Tags: atom/literature/h1, security, supply-chain