Brevo supply-chain attack: a hardcoded Cloudflare key at the edge
On September 14, 2026, an attacker used a Cloudflare API key belonging to Brevo, the email marketing platform formerly called Sendinblue, to run a malicious Cloudflare Worker in front of Brevo’s own sites. For several hours the Worker added a script to brevo.com, sibforms.com and three JavaScript files that customers embed on their websites. The script showed some visitors a fake “verify you are human” page (a ClickFix lure) and tried to plant a backdoor plugin on WordPress sites. Security firm Sansec estimates more than 100,000 customer sites loaded the affected files. Four days earlier, on September 10, Brevo had disclosed a separate SAML single sign-on flaw that gave an attacker access to 138 customer accounts.
TL;DR
- Root cause (per Brevo): a long-lived Cloudflare API key with full account rights sat in application source code.
- Two payloads: a ClickFix overlay for ordinary visitors, and a fake WordPress plugin (named “Web Media Optimizer,” per BleepingComputer) for logged-in admins.
- Why checks missed it: the edits happened at the CDN edge, so Brevo’s origin files stayed clean.
What happened
Brevo says the attacker created a hostname on a Brevo-owned domain at 14:23 UTC on September 14, deployed the Worker five minutes later, and routed it to all of brevo.com at 15:01. At 16:07 the Worker began appending a loader line to three embedded files (the forms script, the Brevo Conversations chat widget and the Brevo SDK loader) and was extended to sibforms.com, which hosts signup and unsubscribe forms. Brevo removed it at 20:30.
Sansec confirmed the injected script on www.brevo.com, meet.brevo.com booking pages, the chat widget’s iframe page and sibforms.com. Every loader pointed to a subdomain of sendibt1.com, a Brevo-owned tracking domain where the attacker had added records. Sansec found a certificate for cdn.sendibt1.com dated August 25, consistent with Brevo’s finding that the key was first misused in late August. Brevo says it found no injected content on customer-facing pages before September 14.
How long were sites exposed?
The sources measure different things:
- Brevo, whole incident: 15:01 to 20:30 UTC, listed as 5 hours 29 minutes. Brevo’s summary calls it “about five and a half hours,” a figure BleepingComputer and SecurityWeek repeat.
- Brevo, ClickFix active: 16:07 to 20:30 UTC (about 4 hours 23 minutes) on brevo.com, sendinblue.com, Brevo login pages, sibforms.com and the three embedded scripts.
- Sansec, observed malware: 16:05:18 to 20:12:53 UTC, about four hours, the figure SecurityWeek cites.
Caching stretched the tail. Sansec logged its last report from a cached copy at 17:45 UTC on September 15, about 21 hours after the window closed.
Timeline
| Date (UTC) | Event | Source |
|---|---|---|
| Aug 25, 17:08 | Certificate issued for cdn.sendibt1.com | Sansec |
| Late Aug | Cloudflare API key first misused | Brevo post-mortem |
| Sep 10, 06:30 | SAML SSO flaw identified; 138 accounts accessed | Brevo SSO write-up |
| Sep 10, 08:30 | SSO route closed, all users signed out | Brevo SSO write-up |
| Sep 14, 14:28 | Malicious Worker deployed | Brevo post-mortem |
| Sep 14, 15:01 | Worker covers all of brevo.com | Brevo post-mortem |
| Sep 14, 16:05 | First malicious sdk-loader.js seen | Sansec |
| Sep 14, 16:07 | Loader added to embedded files; sibforms.com routed | Brevo post-mortem |
| Sep 14, 19:33 | Incident opened | Brevo post-mortem |
| Sep 14, 20:13 | Last malware activity seen | Sansec |
| Sep 14, 20:30 | Worker removed, key revoked | Brevo post-mortem |
| Sep 15 | Malicious hosts stop resolving; customer notices begin | Sansec; Brevo |
| Sep 16 | Sansec analysis published | Sansec |
| Sep 17 | BleepingComputer reports Brevo’s post-mortem as “published today” | BleepingComputer |
The two payloads
Sansec found that the loaded file, f.js, had two branches, both hidden from crawlers, developers and automated scanners.
ClickFix overlay. Brevo says the lure appeared selectively. Targeted visitors got a full-screen page styled as a Cloudflare check, telling them to press Win+R, paste with Ctrl+V and hit Enter. That ran a command the script had already placed on the clipboard, which downloaded malware onto Windows machines. Sansec notes it also reached people who clicked an unsubscribe link in a Brevo campaign email.
Fake WordPress plugin. If the visitor was logged in to WordPress as an admin, the script tried to use that session to upload and activate a plugin from cdn10.sendibt1.com. Sansec could not recover the archive. BleepingComputer found it on VirusTotal and reported that it poses as “Web Media Optimizer,” hides from the plugin list, copies itself into the must-use plugins folder, fetches JavaScript to inject into pages, and holds a hardcoded key that can create an admin session without a password.
Why integrity checks missed it
Brevo says the Worker rewrote responses in transit and stripped headers such as Content-Security-Policy, so the origin stayed untouched and “standard integrity checks did not detect the change.” Sansec had pointed the same way before Brevo confirmed it: the modified files on cdn.brevo.com kept the same Last-Modified dates throughout, and all five Brevo apex domains used Cloudflare DNS, which suggested a single Cloudflare account.
A hash check compares the file on disk with a known-good copy, and an edge Worker never touches that file. A check that fetches the page from outside, the way a visitor does, would see the extra loader line, though Sansec notes the payload itself hid from automated scanners. Sansec’s own evidence came from that side: its Content-Security-Policy monitor recorded 2,549 violation reports across 12 sites.
Brevo’s fix: short-lived, scoped tokens
Brevo says it removed the hardcoded credential and replaced it with narrowly scoped, short-lived tokens. It is moving all Cloudflare keys into HashiCorp Vault with automatic rotation, and is adding alerts that fire whenever Cloudflare’s audit log shows a change to Workers, routes, DNS or who can access the account. It also plans integrity protection for versioned embedded assets and regular external scans of its public pages and scripts.
Brevo has not said how the key was obtained or whether the September 10 SSO incident is connected. SecurityWeek and SecurityAffairs describe the attackers as returning four days later, but BleepingComputer reports that Brevo did not answer that question.
A practical checklist
For developers and platform teams
- Replace account-wide, non-expiring API keys with tokens limited to the zones and permissions a job needs, with an expiry date.
- Run secret scanning on repositories and CI logs, and block commits that contain credentials.
- Alert on edge changes. A new Worker, route, DNS record or account member should page a human.
- Watch what you serve, not just what you store: fetch public pages and scripts from outside and compare hashes and headers.
- Use Subresource Integrity for pinned third-party scripts, plus a CSP with violation reporting.
For WordPress site owners who embed Brevo code
- Search access logs for a POST to
/wp-admin/update.php?action=upload-pluginon September 14, followed shortly by a GET to/wp-admin/plugins.php?action=activate(Sansec). - Compare
wp-content/plugins/andwp-content/mu-plugins/on disk with the admin screen, since the backdoor hides itself. - Remove anything installed that day before rotating admin passwords, because a leftover key can mint sessions. Rotating the WordPress auth salts and checking for unknown admin users also helps.
- Anyone who ran the pasted command should treat that computer as compromised, as Brevo advises.
- Do not block the sendibt1.com apex domain; Sansec notes it is Brevo’s real email tracking domain.
For Brevo account holders
- Anyone who signed in to Brevo via brevo.com on September 14 should change their password and review their API keys as a precaution, as Brevo advises.
Background
A software supply-chain attack reaches many targets through one trusted provider. The Axios npm compromise and the LiteLLM PyPI incident changed package code. In Brevo’s case the origin code never changed; the delivery layer did. Related cases are on our 2026 supply-chain attacks story page and in Tech & Security.
What could go right / What could go wrong
What could go right: Scoped tokens, vault storage and audit-log alerts would limit a leaked key and make a rogue Worker visible quickly. Brevo’s detailed timeline helps customers check their own logs.
What could go wrong: Admins who changed passwords but left a must-use plugin behind may still be exposed. Neither Brevo nor Sansec has said how many visitors ran the ClickFix command.
FAQ
Q What happened in the Brevo supply-chain attack?
A On September 14, 2026, an attacker used a Brevo Cloudflare API key to run a Worker that injected a malicious script into brevo.com, sibforms.com and three embedded Brevo scripts. Sansec estimates more than 100,000 customer sites were affected.
Q How long did the Brevo malicious script run?
A Brevo gives 15:01 to 20:30 UTC (about 5.5 hours) for the whole incident, and says the ClickFix lure itself was active from 16:07. Sansec observed malware from 16:05 to 20:13 UTC, about four hours.
Q What is the Web Media Optimizer plugin?
A BleepingComputer reports it is a fake WordPress backdoor plugin installed through logged-in admins' sessions. It hides from the plugin list and persists in the must-use plugins folder.
Q Is the Brevo SSO breach linked to the Cloudflare attack?
A Brevo has not said. BleepingComputer reports that Brevo did not answer whether the two incidents are connected.
Sources
- Post-mortem: malicious ClickFix script served via Brevo's Cloudflare account
- Incident: Malicious script served via Brevo's Cloudflare account (status updates)
- Write-up: Attacker gained access to client accounts (SAML SSO incident)
- Brevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malware
- Brevo supply-chain attack injected ClickFix scripts on customer sites
- Brevo Supply Chain Attack Injects Malware Into 100,000 Websites
- Brevo Supply-Chain Attack Infected Over 100,000 Websites
