DeepFalcon — Daily Threat Intelligence Report

Threat Landscape Summary — June 16, 2026

One qualifying high-priority finding for June 16 — a textbook native-tool abuse supply-chain attack. Security firm Sansec discovered an active supply-chain attack against three popular WordPress marketing plugins — OptinMonster, TrustPulse, and PushEngage, all owned by Awesome Motive — affecting over 1.2 million websites. Attackers compromised Awesome Motive's CDN infrastructure and injected malicious JavaScript directly into legitimate plugin files. The payload activates only when a logged-in WordPress administrator loads an affected page, then silently hijacks the admin's own valid session to create a hidden rogue admin account and install a self-hiding backdoor plugin — a classic living-off-the-land technique where the malicious activity is indistinguishable from legitimate administrator action at the network layer. BleepingComputer published its coverage within the coverage window confirming the technical details. Two additional items are documented in Strong Leads below: a 10-year Chinese espionage campaign involving PAM/OpenSSH trojanization, and an unresolved extortion threat against the Council of Europe with a deadline of today.

> Coverage windowJun 15 3:30 PM — Jun 16 7:30 AM ET

> Category A qualifying findings0

> Category B (LotL) qualifying findings1 — WordPress plugin supply chain

> Sites affected1.2M+ (OptinMonster alone)

> DiscoverySansec, June 13

> Strong Leads (Section 11)2 — Velvet Ant · Council of Europe

HIGH ★ WordPress CDN Supply-Chain Attack — OptinMonster, TrustPulse & PushEngage Compromised — Malicious JavaScript Hijacks Logged-In Admin Sessions to Create Hidden Rogue Accounts and Install Self-Hiding Backdoor Plugin — 1.2M+ Sites Exposed High 🔧 LotL / Session Hijack ⛓ Supply Chain ▼

Affected Products / Vendor

OptinMonster (1.2M+ active WordPress installs), TrustPulse, and PushEngage — three marketing plugins all owned by Awesome Motive. Compromise occurred at the CDN distribution layer, not within individual customer sites.

Discovery & Timeline

C2 domain tidio.cc registered and TLS-certified April 28, 2026 — indicating advance planning. Malicious code first observed in OptinMonster/TrustPulse api.min.js files June 12, 22:17 UTC; removed by 22:42 UTC (25-min window). PushEngage SDK continued serving malware from some CDN edges until June 14, 08:44 UTC. Sansec disclosed publicly June 13. Awesome Motive published incident notices June 14–15.

Attack Mechanism — Why This Is LotL

The payload does not exploit a plugin vulnerability — it runs entirely client-side in the browser of a logged-in WordPress administrator who loads an affected page. It uses the admin's own valid session cookie and CSRF nonce to issue what looks, at the network layer, like a completely legitimate "add user" request. This is textbook living-off-the-land: the malicious action is indistinguishable from normal administrator behavior using the site's own authentication mechanism.

Detection Evasion

The injected JavaScript exits immediately if it detects a headless browser, a WebDriver, or a zero-size window — defeating most automated scanners. It only proceeds upon confirming wp-admin paths, the admin toolbar, or the wordpress_logged_in_ cookie are present, and uses a 24-hour localStorage throttle to avoid re-triggering and raising suspicion during the same session.

Post-Compromise Actions

Creates a hidden rogue administrator account, then installs a self-hiding backdoor plugin (folder names observed: content-delivery-helper / "Content Delivery Helper" and database-optimizer / "Database Optimizer") that hides itself from both the WordPress admin plugin screen and the REST API used by most security scanning tools. The backdoor plugin exposes an unauthenticated web shell and a code execution endpoint.

Command & Control

Harvested credentials and new rogue-account details are sent to tidio.cc — a domain deliberately registered to resemble the legitimate customer-support platform tidio.com. The lookalike domain and advance TLS certificate registration (April 28) indicate a planned, not opportunistic, campaign.

IOCs — Published by Sansec / Patchstack / BleepingComputer · June 13–15, 2026

🔴 C2 domain: tidio[.]cc (registered 2026-04-28, lookalike of legitimate tidio[.]com)

🔴 Rogue admin account observed: developer_api1 (email: customer1usx[@]gmail[.]com) — also watch for generic dev_xxxxxx pattern accounts

🔴 Backdoor plugin folder: content-delivery-helper ("Content Delivery Helper")

🔴 Backdoor plugin folder: database-optimizer ("Database Optimizer")

Source: Sansec / Patchstack / BleepingComputer — June 13–15, 2026. Search your WordPress installation immediately for these account names and plugin folders.

▶ Defensive Actions

1. Audit WordPress admin accounts immediately on any site running OptinMonster, TrustPulse, or PushEngage — look for unexpected accounts named developer_api1 or matching a dev_xxxxxx pattern, particularly any tied to customer1usx@gmail.com or similar unfamiliar addresses.
2. Search the filesystem under wp-content/plugins for folders named content-delivery-helper or database-optimizer — these will NOT appear in the standard admin plugin list or REST API since the backdoor hides itself from both.
3. Block tidio[.]cc at DNS and firewall level immediately — this is the confirmed C2 destination for harvested credentials.
4. Rotate WordPress admin credentials for any account that was logged in during the exposure windows: June 12 22:17–22:42 UTC (OptinMonster/TrustPulse) or through June 14 08:44 UTC (PushEngage).
5. If a rogue account or backdoor plugin is found, treat the site as fully compromised — the backdoor plugin exposes an unauthenticated web shell, so assume broader access beyond just the admin account compromise. Full WordPress core and file integrity scan required, not just plugin removal.
6. Awesome Motive confirmed they rotated the compromised CDN API key — verify your site is no longer pulling a cached copy of the malicious script from any CDN edge.

MITRE ATT&CK TTPs

T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain) · T1136.001 (Create Account: Local Account) · T1027 (Obfuscated Files or Information — self-hiding plugin) · T1059.007 (Command and Scripting Interpreter: JavaScript) · T1071.001 (Application Layer Protocol: Web Protocols — C2 over HTTPS) · T1505.003 (Server Software Component: Web Shell)

References: Sansec Research — Original Discovery · BleepingComputer — June 15, 2026 · Patchstack — June 15, 2026 · Security Affairs · CyberInsider

Technique ID	Technique Name	Tactic	Observed In
T1195.002	Supply Chain Compromise — Software Supply Chain	Initial Access	Awesome Motive CDN compromise (OptinMonster/TrustPulse/PushEngage)
T1136.001	Create Account — Local Account	Persistence	Hidden rogue WordPress admin account creation via hijacked session
T1027	Obfuscated Files or Information	Defense Evasion	Self-hiding backdoor plugin invisible to admin panel and REST API
T1059.007	Command and Scripting Interpreter — JavaScript	Execution	Client-side malicious JS payload in compromised CDN files
T1071.001	Application Layer Protocol — Web Protocols	Command and Control	HTTPS exfiltration to tidio.cc
T1505.003	Server Software Component — Web Shell	Persistence	Unauthenticated web shell exposed by backdoor plugin

Campaign	Category	Actor	Platform	Sector	Impact	IOCs	First Reported	Priority Action
WordPress CDN Supply Chain — OptinMonster/TrustPulse/PushEngage — Hidden Admin Account Creation	🔧 LotL⛓ Supply Chain	Unattributed — sophisticated, advance C2 planning (April 28 domain registration)	WordPress (OptinMonster, TrustPulse, PushEngage plugins)	Any organization running WordPress with these plugins — broad horizontal exposure	High	✓ 4 IOCs	2026-06-13 (Sansec) / 2026-06-15 (BleepingComputer)	Audit admin accounts · search for backdoor plugin folders · block tidio.cc

🔬 RESEARCH "Operation Highland" — Chinese Espionage Group Velvet Ant Hijacked Authentication Stack and Spied on Air-Gapped Critical Infrastructure Network for a Decade — PAM and OpenSSH Trojanized — Sygnia Research

Sygnia researchers disclosed "Operation Highland," a decade-long cyber-espionage campaign by the Chinese state-linked group Velvet Ant. The intrusion began in 2016 on vulnerable internet-facing systems before the attackers pivoted into an air-gapped critical infrastructure network with no direct external path, building a remote execution route through chained Nginx and FastCGI configuration changes. Once inside the isolated environment, Velvet Ant replaced legitimate PAM (Pluggable Authentication Module) components and trojanized OpenSSH binaries — giving them the ability to steal credentials and observe all administrative activity for ten years without detection. This is one of the most extreme examples of native-tool abuse (LotL) on record: the attackers did not deploy custom malware inside the isolated network at all — they simply replaced the authentication and remote-access tools that were already there.

Why this matters for your environment: Sygnia explicitly recommends treating PAM, OpenSSH, and Windows LSASS as critical security assets requiring file integrity monitoring — not just standard endpoint detection. If your organization maintains any air-gapped or isolated network segment, this case demonstrates that "isolated" does not mean "unreachable" when an attacker is willing to invest years building a path through chained infrastructure misconfigurations.

BleepingComputer / Sygnia · June 13, 2026 · → Read more — BleepingComputer

🕵 BREACH ShinyHunters Claims 297GB Council of Europe Breach — 429,000 Files Including HR, Payroll & Medical Records for 10,000+ Staff — Extortion Deadline Is Today, June 16

ShinyHunters posted claims on its dark web extortion site that it stole approximately 297GB of data — over 429,000 files — from multiple Council of Europe departments including the Secretariat, Human Resources Directorate, Parliamentary Assembly, and EDQM. The claimed data includes more than 409,000 payslips spanning 2011–2026 for over 10,000 staff, 14,000+ CVs, 3,700 internal HR documents, plus bank account details, tax records, social security information, and medical records. The Council of Europe has confirmed it is investigating but has not verified the claims. ShinyHunters set an extortion deadline of today, June 16, 2026 — if no contact is made, the group says it will publish the data. As of this report, the breach claim remains unverified and the deadline outcome is unknown.

Context: ShinyHunters has been linked to the ongoing Oracle PeopleSoft zero-day exploitation campaign documented in prior DeepFalcon reports, as well as breaches of Salesforce customers including Carnival, Canvas, and Grafana. This pattern of sustained, parallel extortion campaigns against multiple high-value targets continues to characterize the group's 2026 operations.

BleepingComputer / SecurityWeek / Cybernews · June 14–15, 2026 · → Read more — BleepingComputer

Living-off-the-Land Is Trending Toward Trust Infrastructure, Not Just Endpoints

Today's two most significant LotL-relevant findings — the WordPress CDN supply-chain attack and the decade-long Velvet Ant PAM/OpenSSH campaign — share a common thread despite their vastly different scale and sophistication: both attacks succeed by abusing trust relationships rather than deploying detectable malware. The WordPress attackers used a legitimate admin's own session cookie. Velvet Ant used the organization's own authentication stack. Neither required the attacker to introduce a foreign executable that endpoint detection tools are built to catch. This is the defining characteristic of 2026's most successful intrusions: attackers increasingly target the trust mechanisms themselves — CDN distribution channels, authentication modules, session tokens — rather than fighting through hardened endpoint defenses.

For defenders, the practical implication is that traditional malware-signature-based detection is structurally blind to this entire category of attack. File integrity monitoring on authentication components (PAM, OpenSSH, LSASS), behavioral anomaly detection on admin account creation patterns, and software bill-of-materials (SBOM) verification for third-party CDN-delivered code are no longer advanced or optional controls — they are baseline requirements for any organization with meaningful attack surface in 2026.