A stolen Brevo Cloudflare API key allowed attackers to inject malicious JavaScript into the marketing platform’s own websites and components embedded across customer sites, potentially exposing more than 1,00,000 websites to ClickFix malware.
Brevo says the attackers created a malicious Cloudflare Worker that modified web responses between 16:07 and 20:30 UTC on September 14.
The incident is particularly serious because customers did not need to have their own servers hacked. Malicious code was delivered through Brevo resources they already trusted and embedded on their websites.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
Stolen API key gave attackers control at the CDN edge
Brevo said the attackers obtained a long-lived Cloudflare API key that had been hardcoded inside application source code.
The credential reportedly carried full account permissions, allowing the attackers to create Cloudflare Workers, routes and DNS records across Brevo-controlled domains.
Instead of modifying Brevo’s original files directly, the attackers altered responses as they passed through Cloudflare’s edge infrastructure.
That distinction helped the attack evade standard integrity checks.
Brevo said the malicious Worker could also strip security headers such as Content-Security-Policy before content reached users.
The affected properties included brevo.com, sendinblue.com, sibforms.com and several Brevo login and onboarding domains. Embedded components such as the Brevo forms script, Conversations widget and SDK loader were also modified.
Customer websites unknowingly delivered the malicious script
The attack turned Brevo into a supply-chain delivery point.
Many websites include Brevo JavaScript for forms, tracking or customer-chat functions.
When those external files were modified, websites loading them could also serve the attacker’s code even though the website owner had made no change.
Sansec says it observed malicious Brevo resources between roughly 16:05 and 20:13 UTC on September 14 and estimates that more than 1,00,000 customer websites could have loaded affected components.
That does not mean 1,00,000 sites were successfully compromised.
Some may simply have loaded the malicious JavaScript during the exposure window, while actual compromise depended on what the visitor did and whether a WordPress administrator was logged in.
ClickFix tricked visitors into running commands themselves
Ordinary visitors could encounter a fake Cloudflare-style verification screen.
The page used a technique known as ClickFix, which tells users they need to complete a technical step to prove they are human or fix a browser problem.
The instructions actually persuade the user to open the Windows Run dialog or another command interface and execute attacker-supplied code.
This is what makes ClickFix effective.
The malware is not necessarily installed automatically by exploiting the browser.
Instead, the victim is manipulated into launching the malicious command themselves.
Because the action appears to be part of a familiar verification process, users may not realise that they are bypassing their own security protections.
WordPress administrators faced a more serious backdoor attempt
The attack behaved differently when it detected that a visitor was logged into a WordPress website as an administrator.
Sansec says the malicious script attempted to upload a plugin from an attacker-controlled address.
BleepingComputer later analysed a copy of the plugin, which called itself “Web Media Optimizer” but functioned as a persistent backdoor and JavaScript loader.
The plugin could hide from the normal WordPress plugin list, copy itself into the must-use plugin directory and periodically contact attacker infrastructure for additional JavaScript.
BleepingComputer also found a hardcoded authentication mechanism capable of generating an administrator session without knowing the genuine account password.
That means a site administrator who merely visited an affected website while logged in could face a significantly greater risk than an ordinary visitor.
Brevo says customer data and email systems were not breached
Brevo removed the malicious Worker and routes, revoked the stolen API key and other attacker-created credentials, deleted malicious hostnames and purged edge caches after detecting the incident.
The company also removed the hardcoded credential from its source code.
Brevo says app.brevo.com, its API, email-delivery infrastructure and customer account data were not affected by this particular attack.
That is important because Brevo suffered a separate SAML SSO incident just days earlier.
On September 10, the company disclosed that an attacker gained access to 138 customer accounts through an SSO scoping flaw. Six accounts were used to send phishing emails and contact lists were exported from 43.
One affected customer was hardware-wallet maker Trezor, which said phishing emails targeted around 3,47,000 addresses and that roughly 2,500 users clicked the malicious link.
Brevo has not publicly established that the SSO incident and the later Cloudflare compromise were connected.
Website owners should check for compromise, not just assume the incident is over
Sansec says Brevo’s malicious files are now clean and the attacker-controlled subdomains stopped resolving on September 15.
But that does not automatically remove malware from WordPress sites where the malicious plugin may already have been installed.
Administrators who used affected Brevo widgets or scripts on September 14 should check for plugins installed or activated that day, particularly anything unfamiliar or hidden from the normal plugin list.
Logs showing suspicious requests to WordPress plugin-upload and activation endpoints may also indicate compromise.
Any administrator account suspected of exposure should have its credentials rotated.
What this means for you
If your website uses Brevo forms, the Conversations widget or Brevo JavaScript, review activity from September 14 and check WordPress installations for unexpected plugins or administrator sessions. Users who followed a fake “verify you are human” prompt and ran a command should treat the device as potentially compromised.
The420 Insight
The attack shows why software supply chains remain so attractive to cybercriminals. Instead of hacking thousands of websites one by one, the attackers compromised a trusted service sitting upstream and let legitimate websites distribute the malicious code for them.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
