MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise

Description

The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the version MonsterInsights rolled back to (10.2.0) contain a malicious file, `class-system-check.php`. Three distinct variants were observed on 2026-06-11, all sharing the same AES-256-GCM key, confirming a single threat actor. The attacker retains write access to the S3 bucket and has been actively iterating on the payload throughout the day.

The 10.2.0 variant (most recent, timestamped 15:02 UTC) is the most dangerous: it hijacks the MonsterInsights and ExactMetrics update mechanisms to redirect all future update checks to the attacker's server (`tidio.cc`), creates a persistent backdoor WordPress admin account, and adds an authentication bypass via GET parameter. This persistence survives plugin removal.

Shared Indicators (All Variants)
AES-256-GCM Key: b147195a3a6c1cc31599e9449d24005f2f3bd493e1c1e0a25a6e5b393a9ff782
AWS IAM Key (from signed download URL): AKIA2QECJAQPPMAUL6XT

Vendor has been informed due to severity.