Trusted WordPress Plugins Were Planting Back Doors

PushEngage, OptinMonster, and TrustPulse are three widely-used WordPress plugins — tools that add functionality to WordPress sites, the platform that powers a large share of the internet — all run by one company, Awesome Motive. They handle push notifications, lead capture forms, and trust badges for millions of sites.

An attacker tampered with the JavaScript files these plugins load from external servers. The malicious code had one specific trigger: it only activated when a site administrator was logged in at the moment the script loaded. When that condition was met, the code quietly created a new admin account under the attacker's control and installed a backdoor (a concealed access point that allows re-entry even after the original intrusion is discovered).

Ordinary visitors never triggered it. Only the site's own admin did — unknowingly, just by doing their job.

Security firm Sansec uncovered the campaign on June 13, finding identical malicious code across all three plugins. PushEngage confirmed the incident the following day. As of June 15, Awesome Motive had not publicly addressed OptinMonster or TrustPulse.

Any site that ran these plugins during the window of compromise should be treated as fully compromised.

What to do:

1. Open your WordPress admin panel and review every listed admin account. Remove any you did not create.
2. Check your installed plugins for anything unfamiliar and delete it.
3. Update all three plugins to their latest versions immediately.
4. Ask your hosting provider to run a malware scan if you have any doubt.

Outsider Enterprise was a phishing-as-a-service (PhaaS) platform — think of it as a criminal franchise where anyone willing to pay could rent a ready-built fake website and a kit to run their own fraud campaign, no technical skill required. Operating out of China and coordinated through Telegram, the platform used AI to generate convincing impersonations of real brands. Customers picked a target brand, received a polished fake site and message templates, then blasted victims via SMS.

The scale was industrial. In just two weeks in May, more than 2.5 million text messages were sent to Android users alone. The platform stole 3.8 million credit card records over three years, across 54 countries, causing an estimated $1.9 billion in losses.

The danger of the PhaaS model is that it turns a technically complex attack into a subscription service. The expertise stays with the platform. The crime scales indefinitely.

What PAN-OS is: PAN-OS is the operating system running Palo Alto Networks firewalls and network security appliances — the software layer that decides what traffic enters and leaves an organisation's network.

What it is: An authentication bypass flaw (a vulnerability that lets someone skip the identity check entirely) in PAN-OS's GlobalProtect component — the VPN gateway that allows remote workers to connect securely to corporate systems. According to Palo Alto Networks, an attacker can exploit it to establish VPN connections without valid credentials.

Who's at risk: Organisations running PAN-OS with GlobalProtect portals or gateways exposed to the internet. Active exploitation has been confirmed, with initial activity observed as far back as 17 May 2026.

CVSS: 7.8 (High — patch this week. Do not delay.)

Root cause: GlobalProtect's portal and gateway components fail to properly verify incoming connection requests. The validation step that should confirm a user is who they claim to be can be bypassed entirely, allowing an attacker to proceed as an authenticated user without ever supplying legitimate credentials.

Attack vector: An attacker sends a crafted request to the GlobalProtect portal or gateway. The system accepts it without completing proper authentication and establishes a VPN session. Palo Alto confirmed that only a fraction of probed devices completed full sessions, but those that did registered as gateway-connected events, placing the attacker inside the network perimeter. No post-access lateral movement (the act of moving from one internal system to another after gaining initial entry) has been identified yet, but the window for it remains open on unpatched devices.

Detection strategies:

1. Audit GlobalProtect gateway logs for VPN sessions from unrecognised source IP addresses, particularly from mid-May 2026 onwards.
2. Look for gateway-connected events with no corresponding legitimate user login record.
3. Flag any unusual admin activity or new account creation following suspicious VPN sessions.

Recommended actions:

1. Apply Palo Alto's current PAN-OS patch immediately. This is actively exploited.
2. Where operationally possible, restrict GlobalProtect portal access to known, approved IP ranges.
3. Review all VPN session logs from mid-May onwards and investigate anything anomalous before clearing it.

The FBI, Google, and Black Lotus Labs dismantled Outsider Enterprise this week as part of a broader operation called Operation Riptide, targeting criminal cybercrime infrastructure at scale. During the technical takedown, the agencies dismantled the platform's infrastructure used to distribute the platform's phishing kits to paying customers.

For everyday people: over 9,000 fake websites and more than a million fraudulent URLs are now offline. Campaigns that were impersonating trusted brands via SMS across AT&T, T-Mobile, and Verizon have been severed from their infrastructure.

Nothing you need to do — this one is a win. But if you received a suspicious text in the past few months impersonating a delivery company, bank, or government agency, check your credit card statements for anything unfamiliar.

A proposed FCC rule would require US telecoms to collect government-issued ID and a physical address from all phone customers, effectively ending anonymous prepaid SIM cards. The stated goal is reducing scam calls and SMS fraud. Privacy advocates argue the requirement mirrors mandatory phone registration laws in authoritarian states where buying a plan without surrendering your identity is not possible.

For everyday users: if it passes, anonymous mobile phone access in the US is finished.