Securify

A stolen API key, a hijacked CDN, and five and a half hours of exposure were all it took to turn one of the world’s largest email-marketing platforms into a malware delivery network. On September 14, attackers weaponized Brevo’s own Cloudflare infrastructure to inject malicious scripts into more than 100,000 customer websites — silently serving ClickFix social-engineering lures and WordPress backdoors to every visitor who loaded a page.

What Is Brevo, and Why Does It Matter?

Brevo, formerly known as Sendinblue, is a marketing and transactional messaging platform used by organizations ranging from eBay and Louis Vuitton to Michelin and Amnesty International. Its core products include email campaigns, CRM, web forms, and a live-chat widget. Crucially, many of these services work by embedding small JavaScript snippets — sdk-loader.js and brevo-conversations.js — directly into customers’ websites. That ubiquitous embed footprint is exactly what the attackers exploited.

How the Attack Unfolded

The root cause was a Cloudflare API key that had been hardcoded in Brevo’s source code with full account permissions. Researchers at Sansec, the Dutch e-commerce security firm that first reported the incident, determined the key was likely compromised in late August 2026, though no malicious activity was observed before September 14.

The attack itself began at 16:07 UTC on September 14 and lasted until roughly 20:30 UTC — about five and a half hours. Rather than modifying files on Brevo’s origin servers (which would have triggered integrity checks), the attackers created a malicious Cloudflare Worker — a serverless function that runs at the CDN edge. The Worker intercepted HTTP responses for several Brevo domains, including brevo.com, sendinblue.com, and sibforms.com, and injected malicious JavaScript into the scripts those domains served. It also stripped Content-Security-Policy headers from responses, ensuring browsers would execute the injected code without objection.

This approach was remarkably stealthy. Because the origin servers remained untouched, standard file-integrity monitoring saw nothing unusual. The poisoned content only existed at the CDN edge, making the attack invisible to anyone inspecting Brevo’s servers directly.

Two Payloads, Two Targets

The injected scripts delivered different payloads depending on who was visiting an affected site.

For ordinary visitors, the script displayed a convincing fake “Verify you are human” Cloudflare page — a textbook ClickFix lure. Victims who followed the instructions were tricked into copying and running a PowerShell command on their Windows machines, downloading malware from attacker-controlled domains yelahaye[.]surf and boiseno[.]club.

For WordPress administrators who happened to be logged in while browsing an affected site, the script took a more surgical approach. It detected the admin session and silently attempted to upload a malicious plugin called “Web Media Optimizer” from cdn10.sendibt1[.]com/p/wm.zip. This plugin was a full-featured backdoor with several persistence mechanisms: it hid itself from the WordPress plugin list, copied itself into the must-use plugins directory (which loads automatically and cannot be disabled through the admin panel), periodically phoned home to glegchner[.]com/ads.php, and stored hardcoded authentication keys that allowed the attackers passwordless admin access to the compromised site.

A Wider Pattern of Compromise

The Cloudflare Worker attack did not occur in isolation. Just four days earlier, on September 10, Brevo had disclosed a separate breach involving improperly scoped SAML SSO access. In that incident, attackers compromised 138 customer accounts, exported contact lists from 43 of them, and sent phishing emails from six accounts — including an account belonging to cryptocurrency hardware wallet maker Trezor. Brevo closed the SSO loophole at 08:30 UTC that day and reset active sessions, but the timeline suggests the attackers had already obtained the Cloudflare API key and were preparing the larger supply-chain strike.

Impact and Fallout

Sansec estimates that more than 100,000 websites embedded at least one of the compromised Brevo scripts. During the roughly four hours the malicious Worker was actively serving poisoned content, every visitor to those sites was exposed to either the ClickFix lure or, if they were a WordPress admin, the backdoor installation attempt.

Brevo’s response team removed the malicious Worker and routes, revoked the compromised API key, eliminated hardcoded credentials from source code, deleted attacker-controlled hostnames, and purged edge caches. In a statement, the company said: “Our investigation indicates the key was first misused in late August 2026. We have found no injection of malicious content into customer-facing pages before 14 September.”

Importantly, Brevo confirmed that app.brevo.com, the platform’s API, its email delivery infrastructure, and stored customer account data were not compromised. The attack was confined to the CDN layer and the JavaScript assets served through it.

Practical Takeaways

For WordPress site owners: If your site embeds any Brevo widget and was active on September 14, audit your plugins immediately. Look for anything called “Web Media Optimizer” or any unfamiliar plugin installed that day. Check the wp-content/mu-plugins/ directory for files you did not place there. Rotate all administrator passwords and review user accounts for unauthorized additions.

For any site using third-party scripts: This incident is a stark reminder that every externally loaded JavaScript file is an implicit trust relationship. Consider implementing Subresource Integrity (SRI) hashes where vendors support them, and use Content Security Policy headers to limit what scripts can do on your pages. Monitor for unexpected changes in the behavior of third-party assets.

For platform vendors: Hardcoded API keys with full account permissions are a ticking bomb. This attack would not have been possible if the Cloudflare key had been scoped to read-only operations or stored in a secrets manager rather than in source code. The broader lesson: audit every credential embedded in your stack for excessive privilege, and assume that if a key exists in source code, it will eventually leak.

What to Watch

The full scope of downstream infections is still being assessed. While Brevo is no longer serving malicious code, any WordPress site that was successfully backdoored during the window remains compromised until its owner finds and removes the “Web Media Optimizer” plugin. Security teams should also watch for follow-on activity from the stolen Trezor-branded phishing emails sent during the earlier SSO breach, which could be used to target cryptocurrency users in the weeks ahead.