TL;DR

Three active threats are hitting businesses right now: a supply chain compromise of popular WordPress plugins (OptinMonster, TrustPulse, PushEngage) via Awesome Motive's CDN, a critical SimpleHelp vulnerability allowing unauthenticated account creation on remote support servers, and a social engineering campaign called ClickFix distributing Vidar Stealer through compromised WordPress sites targeting Australian infrastructure. If your business runs WordPress, uses remote support tools, or hasn't patched in the last 72 hours, you need to act this week — not next.

1. OptinMonster CDN Supply Chain Attack — Your WordPress Plugins May Already Be Compromised

Supply chain attacks don't target your servers directly — they poison the software supply chain upstream, and that's exactly what happened to Awesome Motive's content distribution network (CDN).

What Happened

WordPress plugins maintained by Awesome Motive — including OptinMonster, TrustPulse, and PushEngage — were compromised in a supply chain attack on their CDN infrastructure. Attackers modified the distributed plugin files served through the CDN, meaning that sites pulling updates or fresh installations during the exposure window received tampered code. These plugins collectively run on well over 3 million WordPress sites, making this one of the broadest supply chain compromises in the WordPress ecosystem to date.

How Bad Is It?

The attack surface is enormous. Any site that installed or updated these plugins during the compromised window could be running attacker-injected code. Depending on the payload, this could mean stolen admin credentials, injected payment card skimmers on WooCommerce checkout pages, persistent backdoors in the WordPress installation, or lateral movement into the hosting environment. Supply chain attacks are particularly dangerous because the malicious code arrives signed and trusted — your standard integrity checks won't flag it.

How It Could Have Been Prevented

  • CDN integrity monitoring: Awesome Motive should have enforced subresource integrity (SRI) hashes on all distributed files so any tampering would be detected immediately.
  • Code signing: Distributing plugin packages with cryptographic signatures allows end users to verify authenticity before installation.
  • Network segmentation: Sites that isolate their WordPress installations from backend databases and payment processors limit the blast radius of a compromised plugin.

What Your Business Should Do This Week

  1. Audit every WordPress site your company operates for OptinMonster, TrustPulse, and PushEngage installations.
  2. Update all three plugins to the latest patched versions immediately.
  3. Rotate all WordPress admin credentials, database passwords, and API keys for affected sites.
  4. Review WooCommerce transaction logs and payment gateway configurations for signs of card skimming or data exfiltration.
  5. Deploy a Web Application Firewall (WAF) rule to block known malicious indicators associated with this campaign.

2. SimpleHelp Vulnerability — Rogue Remote Support Accounts on Your Servers

Remote support tools are a goldmine for attackers because they already have elevated access to your infrastructure by design.

What Happened

A vulnerability in SimpleHelp remote management software allows unauthenticated attackers to create privileged technician accounts on servers using OpenID Connect (OIDC) authentication. This means an attacker with no credentials at all can generate a full-access technician login on your SimpleHelp server, then use that account to remotely control any endpoint the server manages. SimpleHelp is widely used by IT service providers and internal IT teams for unattended remote access, making this a potential bridgehead into managed environments.

How Bad Is It?

An attacker who creates a rogue technician account gains the same access level as your legitimate IT staff. They can connect to any managed workstation or server, transfer files, execute commands, and maintain persistence. For managed service providers (MSPs) running SimpleHelp across dozens of client environments, a single compromise could cascade into every customer network they support. This is the exact pattern that made Kaseya and NinjaRider-style attacks so devastating — a single tool compromise becomes hundreds of downstream breaches.

How It Could Have Been Prevented

  • Prompt patching: SimpleHelp has released patches for this vulnerability. Servers not yet updated are still exploitable.
  • OIDC hardening: Enforce multi-factor authentication on all OIDC-authenticated sessions and restrict account creation to verified administrators.
  • Network-level controls: SimpleHelp servers should not be internet-exposed on default ports. Place them behind a VPN or zero-trust network access layer.
  • Privileged account monitoring: Alert on any new technician account creation, especially outside business hours.

What Your Business Should Do This Week

  1. Identify every SimpleHelp server in your environment — including those managed by external IT providers.
  2. Update to the latest patched version immediately. If patching isn't possible within 48 hours, disable OIDC authentication as a temporary mitigation.
  3. Audit all technician accounts for unauthorized entries and remove any you cannot verify.
  4. Review session logs for suspicious remote connections dating back at least 30 days.
  5. Require MFA for all remote support tool access going forward.

3. ClickFix Campaign — Vidar Stealer Targeting Australian Businesses via WordPress

Social engineering meets malware delivery in a campaign that's actively targeting Australian infrastructure through compromised WordPress sites.

What Happened

The Australian Signals Directorate's Australian Cyber Security Centre (ASD ACSC) has issued an advisory warning that threat actors are using a technique called "ClickFix" to distribute Vidar Stealer through compromised WordPress websites. ClickFix works by presenting fake error messages or verification prompts on legitimate-looking web pages — mimicking the "fix" pattern users expect from CAPTCHAs or browser warnings. When users follow the prompts (typically copy-pasting a PowerShell or terminal command to "verify"), they execute Vidar Stealer on their own machines. Vidar is a credential and data theft trojan that harvests saved passwords, browser cookies, cryptocurrency wallets, and session tokens.

How Bad Is It?

Vidar Stealer infections typically lead to cascading compromises. Once an attacker has a user's saved browser credentials and session cookies, they can bypass MFA on email accounts, cloud services, and internal platforms by replaying session tokens. This is frequently the initial access vector for downstream ransomware deployments. The campaign's focus on Australian infrastructure — including government, healthcare, and professional services targets — suggests a deliberate targeting pattern rather than opportunistic spraying.

How It Could Have Been Prevented

  • User awareness training: ClickFix relies on users executing unfamiliar commands. Training staff to never paste commands from websites into terminals would neutralize the majority of infections.
  • Endpoint detection and response (EDR): Modern EDR tools flag PowerShell execution originating from browser processes — a hallmark of ClickFix delivery.
  • WordPress hardening: Compromised WordPress sites are the delivery vector. Regular patching, WAF deployment, and admin panel protection reduce the chance of your own site being weaponized against visitors.

What Your Business Should Do This Week

  1. Brief your team on the ClickFix social engineering pattern — show them what the fake prompts look like.
  2. Deploy application whitelisting or PowerShell Constrained Language Mode on all workstations to prevent script execution from browser origins.
  3. Ensure your EDR solution has signatures or behavioral rules for Vidar Stealer and ClickFix delivery patterns.
  4. Monitor for credential reuse following any suspected exposure — rotate passwords and invalidate active sessions for affected users.
  5. If your business operates WordPress sites, audit them for compromise — you could be an unwitting distribution point.

FAQ

Check the installed plugin versions against the patched versions listed in Awesome Motive's advisory. Then review your web server access logs for unusual outbound connections or file modifications during the exposure window. Run a malware scan using tools like Wordfence or Sucuri, and inspect your WooCommerce checkout templates for injected scripts.

Yes, once updated to the latest patched version, SimpleHelp addresses the OIDC vulnerability. However, you should still audit for rogue accounts that may have been created before the patch, and review session logs for unauthorized remote access. Additionally, restrict SimpleHelp server exposure to the internet and enforce MFA on all technician accounts.

ClickFix bypasses traditional email-based phishing entirely. Instead of sending a malicious link via email, attackers compromise legitimate websites and inject fake verification prompts directly into pages the user is already visiting. The user then copies and pastes a command into their own terminal, effectively self-infecting. This makes it harder for email filters, link scanners, and browser warnings to detect.

The joint advisory on China-nexus covert networks of compromised devices indicates a shift in tactics by state-sponsored actors targeting organisations through compromised IoT devices, routers, and network appliances. While the immediate ClickFix and supply chain threats require urgent action this week, the covert network advisory underscores the importance of inventorying and securing all network-connected devices — not just endpoints and servers.

Conclusion

This week's threat landscape reinforces three uncomfortable truths: your supply chain can betray you, your remote support tools are attack vectors, and your users remain the last line of defense. The OptinMonster CDN compromise proves that even trusted, widely-used plugins can become delivery mechanisms for malicious code. The SimpleHelp vulnerability shows that infrastructure tools with privileged access are high-value targets. And the ClickFix campaign targeting Australian businesses demonstrates that social engineering continues to evolve in sophistication.

Your action items this week are straightforward: patch WordPress plugins and audit for compromise, update or disable SimpleHelp OIDC authentication, train your team on ClickFix, and inventory your exposed infrastructure. Don't wait for a breach notification to take these steps — by then, the damage is done.

Visit consult.lil.business for a free cybersecurity assessment. lilMONSTER can help you identify gaps in your supply chain security, evaluate your remote access infrastructure, and build a resilience plan that holds up against today's threats.

References

  1. ASD ACSC Advisory — ClickFix distributing Vidar Stealer via WordPress targeting Australian infrastructure
  2. BleepingComputer — OptinMonster WordPress plugin hacked in CDN supply-chain attack
  3. BleepingComputer — SimpleHelp bug lets hackers create rogue remote support accounts
  4. ASD ACSC Advisory — Defending against China-nexus covert networks of compromised devices

ELI10: Ransomware Gangs Are Adapting — Here's Why Your Backup Isn't Enough Anymore

TL;DR

  • Ransomware is like someone locking your filing cabinets and demanding payment for the key.
  • Businesses got smart — they started making copies of everything first. So now attackers also steal the files before locking them.
  • The average ransom demand is now over $1 million. 86% of businesses don't pay.
  • The businesses that survive do three things: keep backups criminals can't reach, know exactly how to restore, and watch for suspicious copying before the lock-up happens.

Imagine your business is a restaurant. All your recipes, customer contacts, supplier contracts — everything that keeps the doors open — lives in filing cabinets in the back office.

A ransomware attack is like someone sneaking in overnight, locking every single cabinet with their own padlocks, and leaving a note: "Pay us $1 million and we'll give you the keys."

For years, smart businesses fought back by making copies. Keep a backup of every file somewhere else — your own fireproof safe, an offsite storage unit, a cloud system only you can access. Problem solved, right? If they lock the cabinets, you just use your copies.

Ransomware criminals noticed. And they adapted.

What "Dual Extortion" Means (and Why It Changes Everything)

Now, before attackers lock your filing cabinets, they quietly make their own copies first. Every customer record, every financial document, every private contract — they copy it all out the back door before they lock up.

Then they leave two notes. Note one: "Pay us to unlock your cabinets." Note two: "If you don't pay, we'll post all your private files on the internet for anyone to see."

This is called dual extortion, and it now accounts for 70% of ransomware attacks [1]. Even if you can restore from your backup — even if you never need to pay the ransom — your private data might still end up exposed.

The Real Numbers (Translated)

  • The average ransom demand in 2025 was over $1 million [1]. That went up 47% in a single year.
  • 86 out of 100 businesses that got hit refused to pay [1]. Good call.
  • For the 14% who did pay, negotiators helped get the demand reduced by about 65% — but they still paid an average of $355,000 [1].
  • Retailers saw a 58% jump in ransomware attacks in the middle of 2025. Manufacturers saw a 61% jump [2].

The good news: the amount of damage ransomware causes is actually going down — 19% lower on average than the year before [1]. That's because backup strategies are working. Businesses are recovering without paying. The criminals get nothing.

The 3 Things That Actually Protect You

Think of these as three locks on three different doors.

Lock 1: Backups Criminals Can't Reach Your backup copy needs to live somewhere that an attacker — even one who has already taken over your entire computer system — simply cannot get to. That means separate login credentials, a separate system, and ideally a "write once, read many" storage system where files can be added but never deleted or changed. It's like keeping a copy of your filing cabinet contents in a vault only you can open, with no connection to your main office.

Lock 2: A Tested Recovery Plan Having a copy means nothing if you don't know how to use it under pressure. Write down, step by step, exactly how your business would get back online if every computer was suddenly unusable. Then practice it. The businesses that recover quickly have done this. The ones that struggle haven't.

Lock 3: Watching for the "Copy Before the Lock" Move Because attackers now steal data before they encrypt it, you need to watch for unusual copying or large file transfers happening on your systems — especially outside business hours. Most business email and cloud storage tools have free alert settings for this. Turn them on.

The Other Big Threat: Business Email Scams

Ransomware gets the headlines, but Business Email Compromise is actually the most common cyber insurance claim — 31% of all incidents [1]. This is where someone gets into your email, or pretends to be your accountant or boss, and convinces someone in your business to transfer money somewhere fraudulent.

The average loss is $27,000 per incident [1]. The prevention is simple: for any payment change request that arrives by email, call the person directly to confirm. No exceptions. That one phone call prevents most of these attacks.

What to Do This Week

  1. Check your backup setup: Can a hacker who already has your passwords access your backups? If yes, fix that first.
  2. Write a recovery runbook: If everything broke today, how would you get back up? Write the steps down.
  3. Turn on file transfer alerts: In Microsoft 365 or Google Workspace, turn on alerts for large downloads or unusual sharing activity.
  4. Add a phone confirmation rule: Any payment change request by email must be confirmed by phone. No exceptions.

Your business is already more resilient than it was two years ago — the data proves it. These four steps make that resilience last.

FAQ

Both. The frequency of attacks is flat and the average damage is down 19% — which means backup strategies are working. But attackers have adapted by also stealing data before encrypting it (dual extortion), so the nature of the threat has changed even if the raw financial damage is dropping [1].

Cloud backup services start at under $20/month for small businesses. Microsoft 365 Business includes backup options. The cost of doing nothing is $262,000 on average — and that's the better outcome [1]. This is one of the highest-ROI investments a small business can make.

No — 86% of businesses don't pay and most recover successfully [1]. The key is having backups in place before an attack. Without backups, you're in a much harder position. With them, you restore and move on.

BEC is when attackers either hack into a business email account or convincingly impersonate someone — usually a boss, vendor, or bank — to trick employees into making fraudulent payments. The single best prevention is a verbal confirmation policy: any payment instruction received by email must be confirmed by phone before action is taken [1].

References

[1] Coalition, "2025 Cyber Claims Report," Coalition, 2026. [Online]. Available: https://www.coalitioninc.com/blog/coalition-cyber-claims-report-2025

[2] CyberProof, "CyberProof 2026 Global Threat Intelligence Report," CyberProof, 2026. [Online]. Available: https://www.cyberproof.com/cyberproof-2026-global-threat-intelligence-report/

[3] Help Net Security, "Backup strategies are working, and ransomware gangs are responding with data theft," Help Net Security, March 6, 2026. [Online]. Available: https://www.helpnetsecurity.com/2026/03/06/cyber-claims-report-ransomware-gangs-data-theft/

[4] Cybersecurity and Infrastructure Security Agency, "Malicious Domain Blocking and Reporting (MDBR)," CISA, 2026. [Online]. Available: https://www.cisa.gov/resources-tools/services/malicious-domain-blocking-and-reporting-mdbr

[5] eSecurity Planet, "CyberProof 2026 Report Warns of Rising Identity and AI Cyberattacks," eSecurity Planet, March 6, 2026. [Online]. Available: https://www.esecurityplanet.com/threats/cyberproof-2026-report-warns-of-rising-identity-and-ai-cyberattacks/

Want someone to check if your backup setup would actually survive a ransomware attack? That's exactly what lilMONSTER does. Book a free 30-minute consultation →