Brevo Supply-Chain Attack Injected ClickFix Malware via a Stolen Cloudflare Key

Brevo, the French customer relationship management and email-marketing company formerly known as Sendinblue, confirmed that attackers stole a Cloudflare API key and used it to inject ClickFix malware into its own websites and into JavaScript that thousands of customers embed on their own sites. The tampering happened at the CDN edge and lasted roughly five and a half hours on September 14, 2026, according to Brevo's post-mortem and independent analysis by the Dutch security firm Sansec.

Related reading: Attackers Pushed a Backdoor Through AOMEI Backupper's Own Update Servers · Capcom Says a Breach Exposed 11.7 Million CAPCOM ID Records and Let an Attacker Change 196 Passwords.

The disclosure matters beyond one vendor. A single long-lived credential in a marketing platform's source code gave an attacker write access to the edge layer that sits in front of an estimated 100,000 customer websites. That is the defining risk of embedded third-party scripts: a compromise upstream is inherited by every site that trusts the vendor's tag.

What Brevo confirmed

Brevo said a long-lived Cloudflare API key with full account permissions had been hardcoded in application source code and was obtained by the attacker. With it, the attacker could create Cloudflare Workers, routes and DNS records across Brevo's zones without triggering an alert, the company wrote in its post-mortem.

The malicious Worker rewrote responses as they passed through Cloudflare, which meant Brevo's origin servers and files were never changed. The Worker also stripped security headers such as Content-Security-Policy, the company said, so standard integrity checks did not notice. Brevo's investigation indicates the key was first misused in late August 2026 but found no malicious injection before September 14.

Brevo's timeline puts the overall impact window from 15:01 to 20:30 UTC, a span of 5 hours 29 minutes. The Worker was routed to all of brevo.com at 15:01, then updated at 16:07 to append a loader to three embedded JavaScript files and to cover sibforms.com. Brevo removed the Worker and its routes at 20:30 and said it revoked the key and any credentials created with it, deleted attacker hostnames, purged edge caches and replaced the hardcoded credential with narrowly scoped, short-lived tokens.

Affected domains and scripts

Brevo lists the affected surfaces as brevo.com, sendinblue.com, the login, account, my and onboarding subdomains of brevo.com, and sibforms.com. The three customer-embedded files were the Brevo forms script, the Brevo Conversations chat widget and the Brevo SDK loader.

Sansec, which first reported the campaign, documented the injected code and named two files directly: https://cdn.brevo.com/js/sdk-loader.js and https://conversations-widget.brevo.com/brevo-conversations.js. In each case the tampered file gained a short function that created a new script element and loaded malware from a rotating cdn*.sendibt1.com hostname. Sansec noted that sendibt1.com is owned and operated by Brevo, and that a certificate for cdn.sendibt1.com was created on August 25, which it said shows the attacker had write access to Brevo's DNS.

The two firms describe slightly different clock windows. Sansec observed the first malicious sdk-loader.js at 16:05:18 UTC and the last malware activity from a Brevo domain at 20:12:53 UTC. Brevo describes the injection phase as running until 20:30. Both agree the activity is over: Sansec said every malicious host stopped resolving on September 15 and the origin files are clean, and Brevo said independent verification confirmed all affected pages and scripts were clean by 20:42 on September 14.

Brevo stressed that app.brevo.com, its API, email sending and customer account data held in Brevo were not affected. Malicious content was added in transit, not stored at the source.

What visitors and customers saw

BleepingComputer reported that Brevo confirmed the campaign, and Sansec said the attack served malware to visitors of Brevo's own site and to more than 100,000 customer sites that embed Brevo components. The 100,000 figure comes from Sansec's scan of public web data, not from Brevo, and should be read as an estimate of exposure rather than a count of confirmed infections.

The malware had two behaviours. When an ordinary visitor loaded an affected page, it displayed a full-screen ClickFix overlay: a fake Cloudflare "verify you are human" prompt that told the person to press Win+R, then Ctrl+V, then Enter. Brevo's write-up says a command had already been placed on the clipboard, so following the steps ran attacker code and downloaded malware to the visitor's Windows machine. The overlay was shown selectively, so many visitors and repeat visits saw nothing.

When the visitor was logged into WordPress as an administrator, Sansec found the same script instead tried to install a plugin from https://cdn10.sendibt1.com/p/wm.zip using the admin's own session. Sansec could not retrieve the archive. BleepingComputer later found a copy on VirusTotal and reported that it masquerades as a WordPress plugin called "Web Media Optimizer" but acts as a persistent backdoor and JavaScript loader, hiding itself from the plugin list and copying itself into the must-use plugins directory. Sansec's guidance is to compare the plugin directory on disk against the admin screen, because a plugin can hide from that screen.

ClickFix, explained

ClickFix is a social-engineering technique rather than a software exploit. The page mimics a trusted brand, usually Cloudflare or a captcha vendor, and presents a verification step that requires the user to run a command locally. Because the user performs the action, the malware arrives through a legitimate path that automated blocking and browser warnings are not designed to stop.

The attack also folded a real Cloudflare checkbox into the lure, so a visitor who passed a genuine challenge could be shown the fake follow-up. That reduced suspicion at the exact moment the user was most likely to comply.

Several properties of the Brevo case made ClickFix effective. The fake prompt appeared on the vendor's own domain or on a customer's domain, so the address bar looked right. The malware script ran last in the loader chain, so a spot check of the widget's first lines showed nothing unusual. The kit also refused to activate for crawlers, developers and automated scanners, which delayed detection and reduced the chance that a security tool would see the same page a human did.

Why embedded marketing scripts are a systemic risk

Email and marketing platforms occupy a position that few other vendors do. Their JavaScript runs on customer websites, and their hosted forms and unsubscribe pages receive traffic from every recipient of a campaign. When a platform's edge layer is compromised, the blast radius is the platform's customer base, not the platform alone.

Sansec's write-up makes the amplification explicit: a visitor or email recipient only needed to land on a Brevo-hosted unsubscribe or form page, or load a customer's tracker or chat widget. No stolen customer credential was required to reach an end user. That is what turns a single stolen API key into a campaign against hundreds of thousands of sites.

The architecture of the compromise compounds the operational problem. Because the malicious code lived in a Cloudflare Worker and modified responses on the way out, file-integrity monitoring on the origin saw a clean filesystem. Brevo's own post-mortem notes the Worker removed the Content-Security-Policy header, which is one of the controls that could have limited what an injected script was allowed to do. A defense enforced by the same layer an attacker controls is not much of a defense.

The earlier SSO incident and the Trezor phishing

The Cloudflare compromise followed a separate incident Brevo disclosed on September 10, 2026. In that case, Brevo said, an attacker exploited how the platform handles SAML single sign-on to reach 138 accounts, and the access was not properly limited to the organization where SSO was enabled. According to Brevo, the attacker sent phishing messages to addresses stored under six compromised accounts and exfiltrated contacts from 43 accounts.

One named victim was the hardware wallet maker Trezor, which uses Brevo for newsletters. SecurityWeek reported that Trezor said phishing emails reached roughly 347,000 customer email addresses and that about 2,500 users clicked the link before the malicious site was taken offline around 20 minutes after detection. Trezor warned that entering a wallet backup on the site could cost customers their funds. SecurityWeek noted it was unclear how many users lost funds and how much.

That distinction matters. A large phishing reach and a smaller number of clicks are not the same as confirmed wallet losses. The confirmed figures are 347,000 addresses targeted and at least 2,500 who clicked. The number of compromised wallets has not been established publicly, and reports should not treat it as settled. SecurityWeek also reported that crypto hardware maker BitBox and tax tool CoinTracking appeared to have been affected, without those firms naming Brevo as the source.

Brevo did not answer BleepingComputer's questions about whether the SSO incident and the Cloudflare compromise are connected. The two events are four days apart and both involve access to Brevo's own infrastructure, but no public evidence links them.

Lessons for defenders

The Brevo case reinforces a set of controls that apply to any organization with an edge, cloud or SaaS footprint.

Credential hygiene comes first. The stolen key was long-lived, broadly scoped and stored in source code. Brevo's own remediation is instructive: move secrets into a managed store, rotate them automatically, and issue narrowly scoped, short-lived tokens. Brevo said it is adopting HashiCorp Vault as the single store for Cloudflare keys and tokens, alerting on every Cloudflare audit event that changes Workers, routes, DNS or account access, and streaming Cloudflare logs into its security monitoring.

Inventory your third-party scripts. A site cannot defend a script it does not know it loads. Every embedded tag is a trust decision, and the vendor's security posture becomes part of the customer's attack surface.

Constrain third-party JavaScript where the platform supports it. Subresource Integrity pins a script to a known hash, so a swapped file fails to load, though it is hard to apply to scripts that are updated frequently. A strict Content-Security-Policy limits which domains can execute and blocks inline injection. Both raise the cost and shorten the window against an attacker who controls the edge.

Detect at the edge, not only at the origin. Because the Brevo compromise left origin files untouched, file hashes alone were not enough. Monitoring rendered responses, watching for unexpected header changes and scanning public pages and scripts externally would have a better chance of catching a rewrite in transit.

What Brevo customers should do

Brevo's guidance is direct. Anyone who ran the pasted command should treat the computer as compromised, disconnect it, run a full antivirus scan and change the passwords used on it, starting with the Brevo password. WordPress administrators whose sites load Brevo scripts and who visited those sites while logged in on September 14 should look for plugins installed or activated that day, remove anything suspicious and rotate administrator passwords. Customers who logged into Brevo through brevo.com that day are advised to change their password and review their API keys as a precaution.

Brevo also said the Conversations widget, SDK and forms are safe to use because they were never modified at their source, and that its app, API, email delivery and account data were unaffected.

What to watch

Two questions remain open. The first is whether the Cloudflare key theft is related to the September 10 SSO incident, which Brevo has not answered publicly. The second is the eventual total of confirmed wallet losses from the Trezor phishing, which Trezor and security researchers have so far left unresolved.

For now, the clearest takeaway is structural. A marketing platform sits in the trust chain of a vast number of websites and inboxes, and a single leaked credential at its edge can turn that trust against everyone downstream. The fix is not one control but several: short-lived scoped secrets, enforced script integrity, edge visibility and a current inventory of every third-party tag a site loads.

Cover: The Brevo logo. Image by Brevo via Wikimedia Commons (CC BY-SA 4.0).