{
  "Event": {
    "analysis": "1",
    "date": "2026-06-13",
    "extends_uuid": "",
    "info": "[Threat Intel] OptinMonster supply chain attack hits 1.2 million sites",
    "protected": false,
    "publish_timestamp": "1782253799",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782253799",
    "uuid": "f99b496b-ce4c-43ce-87f6-8024f8c36a0f",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d48a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"",
        "relationship_type": ""
      },
      {
        "colour": "#bb2745",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#56c932",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Account - T1087.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#c8f8ef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Binary Proxy Execution - T1218\"",
        "relationship_type": ""
      },
      {
        "colour": "#edf46c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Timestomp - T1070.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#fe1ef0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Shell - T1505.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#ecc598",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Account - T1136.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#280b0e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"External Proxy - T1090.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#e556be",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Forwarding Rule - T1114.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#7e341c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Users - T1564.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#5ef11e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Impair Command History Logging - T1562.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#7628f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#d596aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Accounts - T1078.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005e",
        "local": false,
        "name": "rectifyq:topic=\"supply-chain\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578873",
        "to_ids": false,
        "type": "link",
        "uuid": "ccbf3e71-a2a8-4545-bb94-260cb7f92af1",
        "value": "https://sansec.io/research/optinmonster-supply-chain-attack",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578873",
        "to_ids": false,
        "type": "text",
        "uuid": "9bf242bf-ad44-495d-9ce7-e3004dac01bd",
        "value": "An active supply-chain attack targeted over 1.2 million WordPress sites using OptinMonster, TrustPulse, and PushEngage plugins operated by Awesome Motive. Attackers injected malicious JavaScript into legitimate files served through Awesome Motive's CDN endpoints. The malware activates when a logged-in administrator accesses the site, creating backdoor admin accounts (developer_api1 and randomized dev_xxxxxx accounts) and installing a self-hiding PHP plugin. The backdoor provides unauthenticated code execution through a web shell and eval endpoint. Stolen credentials are exfiltrated to tidio.cc, a lookalike domain mimicking the legitimate tidio.com. The breach likely originated from compromised Awesome Motive servers or their BunnyNet CDN account. The campaign began in late April 2026 and remained active through mid-June, affecting OptinMonster (over 1 million installations), TrustPulse, and PushEngage users."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781578873",
        "to_ids": false,
        "type": "text",
        "uuid": "eb958afc-cd3b-456b-a99e-2220b89c3bdf",
        "value": "Name: OptinMonster supply chain attack hits 1.2 million sites\nAuthor: AlienVault\nAdversary: \nTags: [\"supply-chain\", \"pushengage\", \"trustpulse\", \"wordpress\", \"backdoor\", \"cdn compromise\", \"awesome motive\", \"optinmonster\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: [\"T1033\", \"T1132.001\", \"T1573.001\", \"T1087.001\", \"T1082\", \"T1140\", \"T1218\", \"T1070.006\", \"T1505.003\", \"T1136.001\", \"T1090.002\", \"T1083\", \"T1114.003\", \"T1564.002\", \"T1562.003\", \"T1059.004\", \"T1027\", \"T1195.002\", \"T1071.001\", \"T1078.003\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233536",
        "to_ids": true,
        "type": "url",
        "uuid": "8e1e9b08-87cf-4471-8187-bfbd14e1f9fc",
        "value": "http://a.opmnstr.com/app/js/api.min.js",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233557",
        "to_ids": true,
        "type": "url",
        "uuid": "20702265-20fb-4958-84b7-cf3d79f74db6",
        "value": "http://a.trstplse.com/app/js/api.min.js",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233578",
        "to_ids": true,
        "type": "url",
        "uuid": "db5ebe8e-5c68-413e-a7ff-89c59202276e",
        "value": "http://tidio.cc/cdn-cgi/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233599",
        "to_ids": true,
        "type": "url",
        "uuid": "8e799738-e9a2-4bfa-b02d-1fcc50e925f4",
        "value": "http://tidio.cc/cdn-cgi/*",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233620",
        "to_ids": true,
        "type": "url",
        "uuid": "e24f1277-3370-4981-beb9-4cb8ff11f86c",
        "value": "http://tidio.cc/cdn-cgi/b",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233641",
        "to_ids": true,
        "type": "url",
        "uuid": "e695bd01-b626-4aab-918c-9e404e065667",
        "value": "http://tidio.cc/cdn-cgi/l",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233662",
        "to_ids": true,
        "type": "url",
        "uuid": "45c04e43-5caa-4439-b2d9-01ad3935c50e",
        "value": "http://tidio.cc/cdn-cgi/p",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233684",
        "to_ids": true,
        "type": "url",
        "uuid": "7bbea87e-cba2-4f76-9029-2c3b35bd969e",
        "value": "http://tidio.cc/cdn-cgi/pe-b",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233705",
        "to_ids": true,
        "type": "url",
        "uuid": "b3dbdd96-7130-48d5-9cb1-862dcfd8faee",
        "value": "http://tidio.cc/cdn-cgi/pe-l",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233726",
        "to_ids": true,
        "type": "url",
        "uuid": "44f0de81-114d-4fce-aa4b-369e68165e02",
        "value": "http://tidio.cc/cdn-cgi/pe-p",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233750",
        "to_ids": true,
        "type": "domain",
        "uuid": "1690c374-c80c-4c15-b468-ffce61c0e5d1",
        "value": "tidio.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233771",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c7b5346a-12a5-4be5-b056-0b84dc229a8c",
        "value": "84.201.6.54",
        "Tag": [
          {
            "colour": "#e6fbdc",
            "local": false,
            "name": "asn:asn=\"214036\"",
            "relationship_type": ""
          },
          {
            "colour": "#18a54c",
            "local": false,
            "name": "asn:as-owner=\"ULTAHOST-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782135350",
        "to_ids": false,
        "type": "AS",
        "uuid": "66be4858-d893-4285-87b6-80a25bc40ded",
        "value": "214036"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233792",
        "to_ids": true,
        "type": "url",
        "uuid": "6ff8fbc5-e00c-4990-8c92-db790cbab1ec",
        "value": "tidio.cc/cdn-cgi/p",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233812",
        "to_ids": true,
        "type": "url",
        "uuid": "7aa33b86-9ffe-4dcb-be52-c93e01a5fad3",
        "value": "tidio.cc/cdn-cgi/b",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233834",
        "to_ids": true,
        "type": "url",
        "uuid": "5d7ccbbc-37ca-4c63-842e-f90c09528cdf",
        "value": "tidio.cc/cdn-cgi/l",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233854",
        "to_ids": true,
        "type": "url",
        "uuid": "8232d400-462c-4f49-8128-319f2850d736",
        "value": "tidio.cc/cdn-cgi/pe-p",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233875",
        "to_ids": true,
        "type": "url",
        "uuid": "65f67701-c286-49eb-8859-67b5d57d5e60",
        "value": "tidio.cc/cdn-cgi/pe-b",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782233896",
        "to_ids": true,
        "type": "url",
        "uuid": "2b5b36dc-fa20-4af0-8184-5c9611494630",
        "value": "tidio.cc/cdn-cgi/pe-l",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782135350",
        "to_ids": true,
        "type": "email-src",
        "uuid": "e3f8c554-9f68-4f66-a0a3-08b74ec7f3a4",
        "value": "customer1usx@gmail.com"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782135350",
        "to_ids": true,
        "type": "email-src",
        "uuid": "9dc59532-ca8b-4098-9a41-e197e26620ff",
        "value": "dev_xxxxxx@gmail.com"
      }
    ]
  }
}