Brevo Supply-Chain Attack: Stolen Cloudflare API Key Deploys Malicious Edge Worker, Backdoors 100,000+ Websites via ClickFix and a Rogue WordPress Plugin

Key facts for Brevo supply chain attack

Detection coverage for Brevo supply chain attack

As of 2026-09-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2573 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Brevo Supply-Chain: Malicious sendibt1.com Edge-Injected Script Load

Detects clients requesting JavaScript from attacker-controlled cdn*.sendibt1.com CDN subdomains, or fetching the /f.js loader or /wm.zip plugin package, indicating the browser or endpoint retrieved content injected via the malicious Cloudflare Worker deployed on Brevo's account with a stolen full-permission API key. This is the initial exploitation vector that delivered both the ClickFix overlay and the WordPress backdoor to 100,000+ downstream Brevo customer sites during the 2026-09-14 16:05-20:13 UTC attack window.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1584, T1195, T1078, T1552, T1608
• Data sources: proxy, web_traffic, dns, cloudflare_audit_logs
• Severity: critical
• Confidence: high

Splunk SPL

index=proxy (sourcetype=proxy OR sourcetype=stream:http) earliest=-24h
| eval dest_host=lower(dest_host)
| where match(dest_host, "(?i)(^|\.)sendibt1\.com$") OR match(uri_path, "(?i)\/f\.js($|\?)") OR match(uri_path, "(?i)\/wm\.zip($|\?)")
| eval referring_asset=if(match(http_referrer, "(?i)(brevo\.com|sibforms\.com|sibautomation\.com|conversations-widget\.brevo\.com|meet\.brevo\.com)"), "brevo_embedded_page", "non_brevo_referrer")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths_requested values(user_agent) as user_agents dc(src_ip) as distinct_clients by dest_host referring_asset
| where distinct_clients > 0
| sort - distinct_clients

Microsoft KQL

let SuspiciousHosts = dynamic(["sendibt1.com","cdn.sendibt1.com","cdn2.sendibt1.com","cdn4.sendibt1.com","cdn10.sendibt1.com","cdn11.sendibt1.com"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (SuspiciousHosts) or RemoteUrl has "/f.js" or RemoteUrl has "/wm.zip"
| extend LoadContext = iff(InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe","safari.exe"), "browser_load", "non_browser_process")
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Requests=count(), Devices=dcount(DeviceName) by RemoteUrl, LoadContext
| order by Devices desc

Sigma

title: Brevo Supply-Chain Attack - Malicious sendibt1.com Edge-Injected Script Load
id: c1a2e3d4-5f6b-47c8-9a1d-2b3c4e5f6071
status: experimental
description: Detects DNS or HTTP requests to attacker-controlled sendibt1.com CDN subdomains, or the /f.js loader and /wm.zip plugin package paths, used to deliver the September 2026 Brevo Cloudflare Worker edge-injection supply-chain attack.
references:
    - https://sansec.io/research/brevo-supply-chain-attack
author: AII-Detector - ThreadLinqs Intelligence
date: 2026/09/18
tags:
    - attack.resource-development
    - attack.t1584
    - attack.initial-access
    - attack.t1195
    - attack.credential-access
    - attack.t1552
logsource:
    category: proxy
    product: null
detection:
    selection_domain:
        c-uri-host|endswith:
            - '.sendibt1.com'
            - 'sendibt1.com'
    selection_path:
        cs-uri-stem|contains:
            - '/f.js'
            - '/wm.zip'
    condition: selection_domain or selection_path
falsepositives:
    - None expected; sendibt1.com is not a legitimate Brevo domain
level: critical

Known false positives:

• None expected during the active incident window since sendibt1.com is attacker-registered infrastructure; if the domain is resold/repurposed after takedown, correlate against current WHOIS/DNS ownership before treating any future hit as benign.

Tuning notes: Feed the full cdn0-cdn11.sendibt1.com subdomain range plus the known file hashes into DNS/proxy blocklists and threat-intel watchlists; the actor may rotate to new cdn*.sendibt1.com subdomains or a new apex domain post-remediation, so refresh the domain list from active threat-intel feeds rather than hardcoding only the IOCs observed on 2026-09-14.

• 🔒 Brevo Supply-Chain: Malicious [indicator] Edge-Injected Script Load · unlock with TL Creds
• 🔒 Web Media Optimizer Backdoored WordPress Plugin - mu-plugins Persistence Install · unlock with TL Creds
• 🔒 Web Media Optimizer C2 Beaconing and ClickFix Backup-Infrastructure Callback · unlock with TL Creds
• 🔒 Brevo Supply-Chain: Malicious [indicator] Edge-Injected Script Load · unlock with TL Creds
• 🔒 Web Media Optimizer Backdoored WordPress Plugin - mu-plugins Persistence Install · unlock with TL Creds
• 🔒 Web Media Optimizer C2 Beaconing and ClickFix Backup-Infrastructure Callback · unlock with TL Creds
• 🔒 Web Media Optimizer Backdoored WordPress Plugin - mu-plugins Persistence Install · unlock with TL Creds
• 🔒 Web Media Optimizer C2 Beaconing and ClickFix Backup-Infrastructure Callback · unlock with TL Creds

Indicators of compromise for Brevo supply chain attack

As of 2026-09-18, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-2573.

Sample indicators (3 of 24)

• IP address: 172.246.243[.]65
• Domain: sendibt1[.]com
• File hash: fe8447fd1ec4dca652b71db2c749fcc24a5bec3875f3654042169fb2418aed09

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

How Brevo supply chain attack works

Between roughly 16:05 and 20:13 UTC on September 14, 2026, the Worker injected malicious JavaScript at the CDN edge into Brevo's own pages and into the sdk-loader.js, brevo-conversations.js and sibforms scripts embedded on 100,000+ customer websites, serving a fake 'verify you are human' ClickFix overlay to visitors and silently deploying a self-hiding backdoored WordPress plugin ('Web Media Optimizer') to logged-in site administrators.

On September 10, 2026 at 06:30 UTC, Brevo (formerly Sendinblue) identified that an attacker had discovered a way to abuse its SAML SSO invitation mechanism: by creating a Brevo organization, enabling SSO on it, and inviting legitimate Brevo users into that attacker-controlled SSO configuration, the attacker could authenticate those users through an identity provider they controlled and sign in as them. Brevo failed to enforce the organization boundary tied to the SSO configuration, so the resulting authenticated sessions extended beyond the attacker's own organization to any other Brevo organization the targeted users belonged to. This gave the attacker access to 138 Brevo accounts; six were used to send phishing emails to the accounts' own contact lists, and 43 had their contact data exported. One of those six accounts belonged to hardware-wallet maker Trezor, whose newsletter list of roughly 347,000 subscribers received phishing emails on September 9 with the subject 'Critical Security Alert: STM32 Entropy Vulnerability' directing recipients to a page requesting their wallet backup information; Trezor took the phishing domain down at the DNS level about 20 minutes after detection, by which point roughly 2,500 recipients had clicked through. BitBox and CoinTracking customers were also targeted in the same wave. Brevo remediated the SSO flaw by 08:30 UTC on September 10, cutting off the attacker's direct SSO-based access.

Brevo's investigation indicates the same or a related actor had separately obtained a long-lived Cloudflare API key with full account permissions that was hardcoded in Brevo's application source code, and had first misused it in late August 2026 without triggering an alert or (per Brevo) injecting malicious content before September 14. An SSL certificate for the attacker's staging subdomain, cdn.sendibt1.com, was issued on August 25, 2026 at 17:08 UTC. At 16:05:18 UTC on September 14 -- roughly 90 minutes after the last clean version of sdk-loader.js was observed at 16:04:23 UTC -- the attacker used the stolen Cloudflare API key to deploy a malicious Cloudflare Worker on Brevo's account. Because the Worker rewrote HTTP responses at the edge (and stripped defensive headers such as Content-Security-Policy) rather than modifying files on Brevo's origin servers, standard file-integrity checks did not detect the tampering. The Worker appended a short loader snippet that pulled in an additional script, f.js, from attacker-controlled cdn*.sendibt1.com subdomains, and injected it into brevo.com, sibforms.com, sibautomation.com, conversations-widget.brevo.com, meet.brevo.com, and -- critically -- the sdk-loader.js and brevo-conversations.js files that Brevo customers embed directly on their own websites. Sansec estimated this reached 100,000+ downstream customer sites, including large brands such as eBay, Louis Vuitton, Michelin and Amnesty International, before the malicious Worker and its DNS records were fully removed by September 15, with the malicious subdomains blacklisted by Maltrail at 11:41 UTC that day.

The injected f.js loader branched on visitor context. Ordinary visitors who matched selection criteria (the malware explicitly avoided crawlers, developers and automated security scanners) were shown a full-page fake Cloudflare 'verify you are human' overlay -- a ClickFix lure -- that instructed them to copy and paste, then run, a command on their own computer, with the actual clipboard payload delivered dynamically from a C2 endpoint. Visitors detected as logged-in WordPress administrators were instead served a silent installation of a plugin package (wm.zip) branded 'Web Media Optimizer.' The plugin copied itself into the wp-content/mu-plugins (must-use plugins) directory for persistence, deliberately hid itself from the normal WordPress admin plugin list, and periodically beaconed to a command-and-control endpoint to fetch base64-encoded backup URLs used to keep injecting the ClickFix overlay even if primary infrastructure was taken down. The plugin also carried a hardcoded authentication key that let the attacker generate a valid WordPress administrator login session without ever knowing the account password, giving them a durable, credential-less backdoor into every WordPress site it successfully implanted on.

Because the compromise lived entirely in the CDN edge layer -- unmodified origin files, unmodified Last-Modified timestamps on cdn.brevo.com assets before, during and after the incident -- it was effectively invisible to any monitoring tool watching the origin rather than what was actually served to browsers. Brevo has confirmed revoking the compromised API key, removing the hardcoded credential from source code, deleting the attacker-created hostnames, and flushing edge caches, stating the environment was clean again by September 15. Brevo has not confirmed whether the SSO-account compromise and the Cloudflare API key compromise were carried out by the same actor, and no attribution has been publicly established for either intrusion.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1564 Hide Artifacts

Command and Control

T1071 Application Layer Protocol

Initial Access

T1078 Valid Accounts; T1195 Supply Chain Compromise; T1199 Trusted Relationship

Execution

T1204 User Execution

Persistence

T1505 Server Software Component

lateral-movement

T1550 Use Alternate Authentication Material

Credential Access

T1552 Unsecured Credentials

Resource Development

T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1608 Stage Capabilities

defense-impairment

T1685 Disable or Modify Tools

Remediation for Brevo supply chain attack

Immediate actions

• Rotate and revoke any long-lived, full-permission Cloudflare API keys or tokens hardcoded in application source code; replace with short-lived, narrowly-scoped tokens stored in a secrets manager
• Audit any WordPress site that embeds a Brevo script (sdk-loader.js, brevo-conversations.js, sibforms) for a plugin named 'Web Media Optimizer', unexpected files under wp-content/mu-plugins/, and POST requests to /wp-admin/update.php?action=upload-plugin or /wp-admin/plugins.php?action=activate around 2026-09-14 16:05-20:13 UTC
• Block and alert on outbound traffic to sendibt1.com and its subdomains (cdn.sendibt1.com through cdn11.sendibt1.com), glegchner.com, corralos.beer, yelahaye.surf and boiseno.club
• Notify end users who saw a fake 'Cloudflare, verify you are human' overlay on a Brevo-embedding site during the attack window and may have pasted/executed a clipboard command, and direct them to run an anti-virus/anti-malware scan
• Force-reset admin credentials and invalidate all active sessions on any WordPress site that had an authenticated administrator session open during the attack window

Workarounds

• Sites embedding Brevo's forms, chat widget or SDK loader can temporarily self-host or pin those scripts via Subresource Integrity instead of loading them live from cdn.brevo.com until the vendor confirms full remediation

Longer-term hardening

• Eliminate hardcoded, account-wide, long-lived API keys from application source code in favor of scoped, short-lived, automatically-rotated credentials
• Enforce SSO organization-boundary checks so an authenticated session created under one organization's SSO configuration cannot be used to access unrelated organizations
• Deploy content-integrity monitoring capable of detecting edge/CDN-layer response tampering (e.g. Subresource Integrity on third-party scripts, CSP violation reporting, synthetic/real-user monitoring of served content) rather than relying solely on origin file-integrity checks
• Move from account-wide Cloudflare API keys to least-privilege, per-zone or per-Worker scoped API tokens with audit logging on Worker/route/DNS-record creation

Affected and fixed versions

• Brevo — Brevo CDN-delivered scripts (sdk-loader.js, brevo-conversations.js, sibforms embed, Conversations widget)
  Vulnerable versions: all live copies served from cdn.brevo.com and sibforms.com between 2026-09-14 16:05 UTC and 2026-09-14 20:13 UTC
  Fixed in: post-incident remediation completed 2026-09-15: Cloudflare API key revoked, malicious Worker/DNS records removed, edge caches flushed
• Brevo — Brevo SAML SSO organization membership enforcement
  Vulnerable versions: SSO implementation active prior to 2026-09-10 08:30 UTC
  Fixed in: remediated by Brevo on 2026-09-10 08:30 UTC
• WordPress (third-party, generic) — WordPress sites embedding any Brevo widget/script
  Vulnerable versions: any WordPress install visited by an authenticated administrator during 2026-09-14 16:05-20:13 UTC while embedding a compromised Brevo script
  Fixed in: not automatically remediated; requires manual removal of the 'Web Media Optimizer' plugin and any mu-plugins backdoor plus admin credential/session reset

Timeline of Brevo supply chain attack

• 2026-08-25 SSL certificate issued at 17:08 UTC for cdn.locked-ioc-20, the attacker's staging subdomain, weeks before the visible Worker attack.
• 2026-09-09 Phishing emails with subject 'Critical Security Alert: STM32 Entropy Vulnerability' sent via a compromised Brevo account to roughly 347,000 Trezor newsletter subscribers; about 2,500 recipients clicked before Trezor pulled the phishing domain via DNS roughly 20 minutes after detection.
• 2026-09-10 At 08:30 UTC, Brevo remediates the SSO vulnerability, cutting off the attacker's direct SSO-based account access.
• 2026-09-10 At 06:30 UTC, Brevo identifies that an attacker abused a SAML SSO organization-boundary flaw to authenticate as users across 138 Brevo accounts; 6 accounts were used to send phishing emails and 43 had contact data exported.
• 2026-09-14 At 20:12:53 UTC, the final malicious activity from Brevo/locked-ioc-20 infrastructure is observed.
• 2026-09-14 During the 16:05-20:13 UTC window, the injected loader serves a fake 'Cloudflare, verify you are human' locked-ioc-22 overlay to ordinary visitors and silently attempts to install the 'locked-ioc-11' backdoored plugin on WordPress sites visited by logged-in administrators.
• 2026-09-14 At 16:05:18 UTC, using the stolen long-lived Cloudflare API key, the attacker deploys a malicious Cloudflare Worker that begins rewriting edge responses on brevo.com, sibforms.com and Brevo's embeddable SDK/widget scripts, stripping the Content-Security-Policy header.
• 2026-09-14 At 16:04:23 UTC, the last clean (untampered) version of Brevo's sdk-loader.js is observed before the edge injection begins.
• 2026-09-15 At 11:41 UTC, Maltrail blacklists the malicious locked-ioc-20 subdomains used in the attack.
• 2026-09-15 Brevo revokes the compromised Cloudflare API key, removes the hardcoded credential from source code, deletes attacker-created hostnames and flushes edge caches, confirming the environment was clean by this date; all malicious subdomains stop resolving.
• 2026-09-18 locked-ioc-24 publishes its technical research and the attack receives broad public reporting (Security Affairs, BleepingComputer, SecurityWeek, CyberNews, GBHackers).

Sources cited for Brevo supply chain attack

• Brevo supply chain attack hits 100k+ sites with WordPress backdoors and ClickFix malware sansec.io · Research · 2026-09-18
• Crypto customers targeted by scammers after email marketing provider breach malwarebytes.com · Blog · 2026-09-18
• Brevo Supply-Chain Attack Infected Over 100,000 Websites securityaffairs.com · News · 2026-09-18
• Brevo supply-chain attack injected ClickFix scripts on customer sites BleepingComputer · News · 2026-09-18
• Brevo Supply Chain Attack Injects Malware Into 100,000 Websites SecurityWeek · News · 2026-09-18
• Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack SecurityWeek · News · 2026-09-11
• Brevo hack: 100,000+ websites serve malware for hours in a supply chain attack cybernews.com · News · 2026-09-18
• Hackers Turn Brevo Widgets Into Malware Delivery Channel Across 100,000+ Websites gbhackers.com · News · 2026-09-18

More in supply chain

• Software Supply Chain Attacks Overview: CCleaner, Codecov, SolarWinds Orion, npm Shai-Hulud, Kaseya VSA, MOVEit Transfer
• BO Team (Black Owl) Supply Chain Attack Against a Software Developer's Infrastructure (CVE-2021-44228)
• Backdoored ARTEX Docker Hub images (tomicdd/artex and clones) expose 62 consoles to unauthenticated root shell; CERT-In CIAD-2026-0058 flags AI-assisted actor Crafty Falcon
• PolinRider Loader Reappears in Hijacked npm Packages (12 malicious releases across 10 packages)
• NIKKE PC Game Launcher CDN Compromise Delivers K2F Remote Access and Data-Stealing Malware

Previous and next in supply chain

• PhantomRaven: LLM-Generated npm Information Stealer Used for Bug Bounty Hunting Previous report
• GHAPPIER Loader: npm Supply-Chain Compromise of @dforge-core/dforge-mcp Linked to DPRK PolinRider Campaign Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages