OptinMonster CDN leak — are you still pulling it?
June 2026: Sansec found tampered OptinMonster / TrustPulse / PushEngage scripts on Awesome Motive CDNs. Enter your domain — we check whether the storefront still loads those hosts.
In June 2026 Sansec published a supply-chain advisory about OptinMonster, TrustPulse and PushEngage — WordPress marketing plugins run by Awesome Motive. Attackers did not break into each customer site one by one. They changed the JavaScript files that those plugins load from vendor CDN hosts. Any storefront that still embeds those script URLs pulled the tampered file the next time a page loaded.
Sansec compared the pattern to the 2024 polyfill.io incident: compromise one upstream CDN object, and malware fans out to every site that trusts that host. The payload was careful. It skipped headless browsers and ordinary visitors. It waited for a logged-in WordPress administrator, then used the admin session to create rogue admin accounts and install a self-hiding backdoor plugin. Credentials were sent to a lookalike command-and-control host.
The distribution hosts called out in the public write-up include a.omappapi.com, a.opmnstr.com, a.optnmstr.com for OptinMonster, a.trstplse.com for TrustPulse, and clientcdn.pushengage.com for PushEngage. If your homepage HTML still references those hosts in script src attributes, you are still on the same trust path that carried the incident — even if the live file is clean again today.
Orb44’s public check does not pentest your WordPress admin, does not log in, and does not claim the site is “safe.” It fetches the public homepage, lists script sources, and matches them against the published CDN host catalog for this incident. Green means those hosts were not seen on the homepage we fetched. Red means at least one matching script URL is still present.
What to do if you used these plugins during the window: remove unexpected WordPress admins (including names like developer_api1 or odd dev_ accounts), search the filesystem for hidden plugins such as content-delivery-helper or database-optimizer rather than trusting the dashboard list, rotate admin passwords and secrets, and prefer server-side malware scanning. Then re-check the storefront here so you know the CDN hosts are gone from the public HTML.
This page is an archival named landing for the OptinMonster CDN leak day. Source of the technical facts: Sansec’s advisory. Use the checker on orb44.com/optinmonster. For a full perimeter snapshot — ports, shield, checkout path, reputation — open the Orb44 cabinet.