Brevo Supply-Chain Attack: Stolen Cloudflare API Key Deploys Malicious Edge Worker, Backdoors 100,000+ Websites via ClickFix and a Rogue WordPress Plugin
Brevo Supply-Chain Attack (TL-2026-2573) is a critical-severity supply-chain compromise, first published 2026-09-18. It has no confirmed attribution, affects Brevo Brevo CDN-delivered scripts (sdk-loader.js, maps to 14 MITRE ATT&CK techniques (T1027, T1071, T1078), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-2573
- Threat ID
- TL-2026-2573
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-09-18
- Last reviewed
- 2026-09-18
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- ecommerce, retail, cryptocurrency, financial-services, non-profit organisation, manufacturing, technology
- Target regions
- Europe, North America, Global
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in Brevo Supply-Chain Attack
Malware and tooling: ClickFix, Web Media Optimizer
An attacker who first abused a SAML SSO organization-boundary flaw to hijack 138 Brevo accounts later used a long-lived, full-permission Cloudflare API key hardcoded in Brevo's application source code to deploy a malicious Cloudflare Worker on Brevo's account. Between roughly 16:05 and 20:13 UTC on September 14, 2026, the Worker injected malicious JavaScript at the CDN edge into Brevo's own pages and into the sdk-loader.js, brevo-conversations.js and sibforms scripts embedded on 100,000+ customer websites, serving a fake 'verify you are human' ClickFix overlay to visitors and silently deploying a self-hiding backdoored WordPress plugin ('Web Media Optimizer') to logged-in site administrators.
How Brevo Supply-Chain Attack works
On September 10, 2026 at 06:30 UTC, Brevo (formerly Sendinblue) identified that an attacker had discovered a way to abuse its SAML SSO invitation mechanism: by creating a Brevo organization, enabling SSO on it, and inviting legitimate Brevo users into that attacker-controlled SSO configuration, the attacker could authenticate those users through an identity provider they controlled and sign in as them. Brevo failed to enforce the organization boundary tied to the SSO configuration, so the resulting authenticated sessions extended beyond the attacker's own organization to any other Brevo organization the targeted users belonged to. This gave the attacker access to 138 Brevo accounts; six were used to send phishing emails to the accounts' own contact lists, and 43 had their contact data exported. One of those six accounts belonged to hardware-wallet maker Trezor, whose newsletter list of roughly 347,000 subscribers received phishing emails on September 9 with the subject 'Critical Security Alert: STM32 Entropy Vulnerability' directing recipients to a page requesting their wallet backup information; Trezor took the phishing domain down at the DNS level about 20 minutes after detection, by which point roughly 2,500 recipients had clicked through. BitBox and CoinTracking customers were also targeted in the same wave. Brevo remediated the SSO flaw by 08:30 UTC on September 10, cutting off the attacker's direct SSO-based access.
Brevo's investigation indicates the same or a related actor had separately obtained a long-lived Cloudflare API key with full account permissions that was hardcoded in Brevo's application source code, and had first misused it in late August 2026 without triggering an alert or (per Brevo) injecting malicious content before September 14. An SSL certificate for the attacker's staging subdomain, cdn.sendibt1.com, was issued on August 25, 2026 at 17:08 UTC. At 16:05:18 UTC on September 14 -- roughly 90 minutes after the last clean version of sdk-loader.js was observed at 16:04:23 UTC -- the attacker used the stolen Cloudflare API key to deploy a malicious Cloudflare Worker on Brevo's account. Because the Worker rewrote HTTP responses at the edge (and stripped defensive headers such as Content-Security-Policy) rather than modifying files on Brevo's origin servers, standard file-integrity checks did not detect the tampering. The Worker appended a short loader snippet that pulled in an additional script, f.js, from attacker-controlled cdn*.sendibt1.com subdomains, and injected it into brevo.com, sibforms.com, sibautomation.com, conversations-widget.brevo.com, meet.brevo.com, and -- critically -- the sdk-loader.js and brevo-conversations.js files that Brevo customers embed directly on their own websites. Sansec estimated this reached 100,000+ downstream customer sites, including large brands such as eBay, Louis Vuitton, Michelin and Amnesty International, before the malicious Worker and its DNS records were fully removed by September 15, with the malicious subdomains blacklisted by Maltrail at 11:41 UTC that day.
The injected f.js loader branched on visitor context. Ordinary visitors who matched selection criteria (the malware explicitly avoided crawlers, developers and automated security scanners) were shown a full-page fake Cloudflare 'verify you are human' overlay -- a ClickFix lure -- that instructed them to copy and paste, then run, a command on their own computer, with the actual clipboard payload delivered dynamically from a C2 endpoint. Visitors detected as logged-in WordPress administrators were instead served a silent installation of a plugin package (wm.zip) branded 'Web Media Optimizer.' The plugin copied itself into the wp-content/mu-plugins (must-use plugins) directory for persistence, deliberately hid itself from the normal WordPress admin plugin list, and periodically beaconed to a command-and-control endpoint to fetch base64-encoded backup URLs used to keep injecting the ClickFix overlay even if primary infrastructure was taken down. The plugin also carried a hardcoded authentication key that let the attacker generate a valid WordPress administrator login session without ever knowing the account password, giving them a durable, credential-less backdoor into every WordPress site it successfully implanted on.
Because the compromise lived entirely in the CDN edge layer -- unmodified origin files, unmodified Last-Modified timestamps on cdn.brevo.com assets before, during and after the incident -- it was effectively invisible to any monitoring tool watching the origin rather than what was actually served to browsers. Brevo has confirmed revoking the compromised API key, removing the hardcoded credential from source code, deleting the attacker-created hostnames, and flushing edge caches, stating the environment was clean again by September 15. Brevo has not confirmed whether the SSO-account compromise and the Cloudflare API key compromise were carried out by the same actor, and no attribution has been publicly established for either intrusion.
MITRE ATT&CK techniques used in TL-2026-2573
Defense Evasion
T1027 Obfuscated Files or Information; T1564 Hide Artifacts
Command and Control
T1071 Application Layer Protocol
Initial Access
T1078 Valid Accounts; T1195 Supply Chain Compromise; T1199 Trusted Relationship
Execution
Persistence
T1505 Server Software Component
lateral-movement
T1550 Use Alternate Authentication Material
Credential Access
Resource Development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1608 Stage Capabilities
defense-impairment
Affected products and versions in Brevo Supply-Chain Attack
- Brevo — Brevo CDN-delivered scripts (sdk-loader.js, brevo-conversations.js, sibforms embed, Conversations widget)
Vulnerable versions: all live copies served from cdn.brevo.com and sibforms.com between 2026-09-14 16:05 UTC and 2026-09-14 20:13 UTC
Fixed in: post-incident remediation completed 2026-09-15: Cloudflare API key revoked, malicious Worker/DNS records removed, edge caches flushed - Brevo — Brevo SAML SSO organization membership enforcement
Vulnerable versions: SSO implementation active prior to 2026-09-10 08:30 UTC
Fixed in: remediated by Brevo on 2026-09-10 08:30 UTC - WordPress (third-party, generic) — WordPress sites embedding any Brevo widget/script
Vulnerable versions: any WordPress install visited by an authenticated administrator during 2026-09-14 16:05-20:13 UTC while embedding a compromised Brevo script
Fixed in: not automatically remediated; requires manual removal of the 'Web Media Optimizer' plugin and any mu-plugins backdoor plus admin credential/session reset
Remediation for Brevo Supply-Chain Attack
Immediate actions
- Rotate and revoke any long-lived, full-permission Cloudflare API keys or tokens hardcoded in application source code; replace with short-lived, narrowly-scoped tokens stored in a secrets manager
- Audit any WordPress site that embeds a Brevo script (sdk-loader.js, brevo-conversations.js, sibforms) for a plugin named 'Web Media Optimizer', unexpected files under wp-content/mu-plugins/, and POST requests to /wp-admin/update.php?action=upload-plugin or /wp-admin/plugins.php?action=activate around 2026-09-14 16:05-20:13 UTC
- Block and alert on outbound traffic to sendibt1.com and its subdomains (cdn.sendibt1.com through cdn11.sendibt1.com), glegchner.com, corralos.beer, yelahaye.surf and boiseno.club
- Notify end users who saw a fake 'Cloudflare, verify you are human' overlay on a Brevo-embedding site during the attack window and may have pasted/executed a clipboard command, and direct them to run an anti-virus/anti-malware scan
- Force-reset admin credentials and invalidate all active sessions on any WordPress site that had an authenticated administrator session open during the attack window
Workarounds
- Sites embedding Brevo's forms, chat widget or SDK loader can temporarily self-host or pin those scripts via Subresource Integrity instead of loading them live from cdn.brevo.com until the vendor confirms full remediation
Longer-term hardening
- Eliminate hardcoded, account-wide, long-lived API keys from application source code in favor of scoped, short-lived, automatically-rotated credentials
- Enforce SSO organization-boundary checks so an authenticated session created under one organization's SSO configuration cannot be used to access unrelated organizations
- Deploy content-integrity monitoring capable of detecting edge/CDN-layer response tampering (e.g. Subresource Integrity on third-party scripts, CSP violation reporting, synthetic/real-user monitoring of served content) rather than relying solely on origin file-integrity checks
- Move from account-wide Cloudflare API keys to least-privilege, per-zone or per-Worker scoped API tokens with audit logging on Worker/route/DNS-record creation
Weaknesses (CWE) in Brevo Supply-Chain Attack
CWE-798, CWE-284
Timeline of Brevo Supply-Chain Attack
- SSL certificate issued at 17:08 UTC for cdn.sendibt1.com, the attacker's staging subdomain, weeks before the visible Worker attack.
- Phishing emails with subject 'Critical Security Alert: STM32 Entropy Vulnerability' sent via a compromised Brevo account to roughly 347,000 Trezor newsletter subscribers; about 2,500 recipients clicked before Trezor pulled the phishing domain via DNS roughly 20 minutes after detection.
- At 08:30 UTC, Brevo remediates the SSO vulnerability, cutting off the attacker's direct SSO-based account access.
- At 06:30 UTC, Brevo identifies that an attacker abused a SAML SSO organization-boundary flaw to authenticate as users across 138 Brevo accounts; 6 accounts were used to send phishing emails and 43 had contact data exported.
- At 20:12:53 UTC, the final malicious activity from Brevo/sendibt1.com infrastructure is observed.
- During the 16:05-20:13 UTC window, the injected loader serves a fake 'Cloudflare, verify you are human' ClickFix overlay to ordinary visitors and silently attempts to install the 'Web Media Optimizer' backdoored plugin on WordPress sites visited by logged-in administrators.
- At 16:05:18 UTC, using the stolen long-lived Cloudflare API key, the attacker deploys a malicious Cloudflare Worker that begins rewriting edge responses on brevo.com, sibforms.com and Brevo's embeddable SDK/widget scripts, stripping the Content-Security-Policy header.
- At 16:04:23 UTC, the last clean (untampered) version of Brevo's sdk-loader.js is observed before the edge injection begins.
- At 11:41 UTC, Maltrail blacklists the malicious sendibt1.com subdomains used in the attack.
- Brevo revokes the compromised Cloudflare API key, removes the hardcoded credential from source code, deletes attacker-created hostnames and flushes edge caches, confirming the environment was clean by this date; all malicious subdomains stop resolving.
- Sansec publishes its technical research and the attack receives broad public reporting (Security Affairs, BleepingComputer, SecurityWeek, CyberNews, GBHackers).
Sources cited for Brevo Supply-Chain Attack
- Brevo supply chain attack hits 100k+ sites with WordPress backdoors and ClickFix malware
- Brevo Supply-Chain Attack Infected Over 100,000 Websites
- Brevo supply-chain attack injected ClickFix scripts on customer sites
- Brevo Supply Chain Attack Injects Malware Into 100,000 Websites
- Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack
- Brevo hack: 100,000+ websites serve malware for hours in a supply chain attack
- Hackers Turn Brevo Widgets Into Malware Delivery Channel Across 100,000+ Websites
- Crypto customers targeted by scammers after email marketing provider breach
More in supply chain
- PhantomRaven: LLM-Generated npm Information Stealer Used for Bug Bounty Hunting
- Admin Menu Editor Pro WordPress Plugin Backdoored via Supply-Chain Compromise, 1,500 Sites Affected
- SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor
- GemStuffer: AI Agent Swarm Floods RubyGems With 2,000+ Malicious Packages, Achieves RCE via RubyDoc.info Build System, Attempts API Key Theft
- OpenAI Agent Swarm ("GemStuffer") Flooded RubyGems With 2,000+ Malicious Packages, Achieved RCE on RubyDoc.info Build Servers
Detection coverage for TL-2026-2573
As of 2026-09-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2573 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.