# Brevo Supply-Chain Attack: Stolen Cloudflare API Key Deploys Malicious Edge Worker, Backdoors 100,000+ Websites via ClickFix and a Rogue WordPress Plugin

> An attacker who first abused a SAML SSO organization-boundary flaw to hijack 138 Brevo accounts later used a long-lived, full-permission Cloudflare API key hardcoded in Brevo's application source code to deploy a malicious Cloudflare Worker on Brevo's account. Between roughly 16:05 and 20:13 UTC on September 14, 2026, the Worker injected malicious JavaScript at the CDN edge into Brevo's own pages and into the sdk-loader.js, brevo-conversations.js and sibforms scripts embedded on 100,000+ customer websites, serving a fake 'verify you are human' ClickFix overlay to visitors and silently deploying a self-hiding backdoored WordPress plugin ('Web Media Optimizer') to logged-in site administrators.

- **Published:** 2026-09-18T00:00:00Z
- **Last reviewed:** 2026-09-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2573
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-brevo-supply-chain-attack-tl-2026-2573.webp?v=02bff042 (Threadlinqs threat intel: Brevo Supply Chain Attack 100K+ Sites: Detection & IOCs (TL-2026-2573) — Critical severity, 24 IOCs, 9 detection rules.)
- **ID:** TL-2026-2573
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (3 shown free below)

## Description

On September 10, 2026 at 06:30 UTC, Brevo (formerly Sendinblue) identified that an attacker had discovered a way to abuse its SAML SSO invitation mechanism: by creating a Brevo organization, enabling SSO on it, and inviting legitimate Brevo users into that attacker-controlled SSO configuration, the attacker could authenticate those users through an identity provider they controlled and sign in as them. Brevo failed to enforce the organization boundary tied to the SSO configuration, so the resulting authenticated sessions extended beyond the attacker's own organization to any other Brevo organization the targeted users belonged to. This gave the attacker access to 138 Brevo accounts; six were used to send phishing emails to the accounts' own contact lists, and 43 had their contact data exported. One of those six accounts belonged to hardware-wallet maker Trezor, whose newsletter list of roughly 347,000 subscribers received phishing emails on September 9 with the subject 'Critical Security Alert: STM32 Entropy Vulnerability' directing recipients to a page requesting their wallet backup information; Trezor took the phishing domain down at the DNS level about 20 minutes after detection, by which point roughly 2,500 recipients had clicked through. BitBox and CoinTracking customers were also targeted in the same wave. Brevo remediated the SSO flaw by 08:30 UTC on September 10, cutting off the attacker's direct SSO-based access.

Brevo's investigation indicates the same or a related actor had separately obtained a long-lived Cloudflare API key with full account permissions that was hardcoded in Brevo's application source code, and had first misused it in late August 2026 without triggering an alert or (per Brevo) injecting malicious content before September 14. An SSL certificate for the attacker's staging subdomain, cdn.sendibt1.com, was issued on August 25, 2026 at 17:08 UTC. At 16:05:18 UTC on September 14 -- roughly 90 minutes after the last clean version of sdk-loader.js was observed at 16:04:23 UTC -- the attacker used the stolen Cloudflare API key to deploy a malicious Cloudflare Worker on Brevo's account. Because the Worker rewrote HTTP responses at the edge (and stripped defensive headers such as Content-Security-Policy) rather than modifying files on Brevo's origin servers, standard file-integrity checks did not detect the tampering. The Worker appended a short loader snippet that pulled in an additional script, f.js, from attacker-controlled cdn*.sendibt1.com subdomains, and injected it into brevo.com, sibforms.com, sibautomation.com, conversations-widget.brevo.com, meet.brevo.com, and -- critically -- the sdk-loader.js and brevo-conversations.js files that Brevo customers embed directly on their own websites. Sansec estimated this reached 100,000+ downstream customer sites, including large brands such as eBay, Louis Vuitton, Michelin and Amnesty International, before the malicious Worker and its DNS records were fully removed by September 15, with the malicious subdomains blacklisted by Maltrail at 11:41 UTC that day.

The injected f.js loader branched on visitor context. Ordinary visitors who matched selection criteria (the malware explicitly avoided crawlers, developers and automated security scanners) were shown a full-page fake Cloudflare 'verify you are human' overlay -- a ClickFix lure -- that instructed them to copy and paste, then run, a command on their own computer, with the actual clipboard payload delivered dynamically from a C2 endpoint. Visitors detected as logged-in WordPress administrators were instead served a silent installation of a plugin package (wm.zip) branded 'Web Media Optimizer.' The plugin copied itself into the wp-content/mu-plugins (must-use plugins) directory for persistence, deliberately hid itself from the normal WordPress admin plugin list, and periodically beaconed to a command-and-control endpoint to fetch base64-encoded backup URLs used to keep injecting the ClickFix overlay even if primary infrastructure was taken down. The plugin also carried a hardcoded authentication key that let the attacker generate a valid WordPress administrator login session without ever knowing the account password, giving them a durable, credential-less backdoor into every WordPress site it successfully implanted on.

Because the compromise lived entirely in the CDN edge layer -- unmodified origin files, unmodified Last-Modified timestamps on cdn.brevo.com assets before, during and after the incident -- it was effectively invisible to any monitoring tool watching the origin rather than what was actually served to browsers. Brevo has confirmed revoking the compromised API key, removing the hardcoded credential from source code, deleting the attacker-created hostnames, and flushing edge caches, stating the environment was clean again by September 15. Brevo has not confirmed whether the SSO-account compromise and the Cloudflare API key compromise were carried out by the same actor, and no attribution has been publicly established for either intrusion.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1584 Compromise Infrastructure
- T1552 Unsecured Credentials
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1195 Supply Chain Compromise
- T1204 User Execution
- T1505 Server Software Component
- T1564 Hide Artifacts
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1550 Use Alternate Authentication Material
- T1071 Application Layer Protocol

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Brevo Supply-Chain: Malicious sendibt1.com Edge-Injected Script Load** (`TL-2026-2573-SPL-001`)

Detects clients requesting JavaScript from attacker-controlled cdn*.sendibt1.com CDN subdomains, or fetching the /f.js loader or /wm.zip plugin package, indicating the browser or endpoint retrieved content injected via the malicious Cloudflare Worker deployed on Brevo's account with a stolen full-permission API key. This is the initial exploitation vector that delivered both the ClickFix overlay and the WordPress backdoor to 100,000+ downstream Brevo customer sites during the 2026-09-14 16:05-20:13 UTC attack window.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1584, T1195, T1078, T1552, T1608
- **Data sources:** proxy, web_traffic, dns, cloudflare_audit_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=proxy (sourcetype=proxy OR sourcetype=stream:http) earliest=-24h
| eval dest_host=lower(dest_host)
| where match(dest_host, "(?i)(^|\.)sendibt1\.com$") OR match(uri_path, "(?i)\/f\.js($|\?)") OR match(uri_path, "(?i)\/wm\.zip($|\?)")
| eval referring_asset=if(match(http_referrer, "(?i)(brevo\.com|sibforms\.com|sibautomation\.com|conversations-widget\.brevo\.com|meet\.brevo\.com)"), "brevo_embedded_page", "non_brevo_referrer")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths_requested values(user_agent) as user_agents dc(src_ip) as distinct_clients by dest_host referring_asset
| where distinct_clients > 0
| sort - distinct_clients
```

### Microsoft KQL

```kql
let SuspiciousHosts = dynamic(["sendibt1.com","cdn.sendibt1.com","cdn2.sendibt1.com","cdn4.sendibt1.com","cdn10.sendibt1.com","cdn11.sendibt1.com"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (SuspiciousHosts) or RemoteUrl has "/f.js" or RemoteUrl has "/wm.zip"
| extend LoadContext = iff(InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe","safari.exe"), "browser_load", "non_browser_process")
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Requests=count(), Devices=dcount(DeviceName) by RemoteUrl, LoadContext
| order by Devices desc
```

### Sigma

```yaml
title: Brevo Supply-Chain Attack - Malicious sendibt1.com Edge-Injected Script Load
id: c1a2e3d4-5f6b-47c8-9a1d-2b3c4e5f6071
status: experimental
description: Detects DNS or HTTP requests to attacker-controlled sendibt1.com CDN subdomains, or the /f.js loader and /wm.zip plugin package paths, used to deliver the September 2026 Brevo Cloudflare Worker edge-injection supply-chain attack.
references:
    - https://sansec.io/research/brevo-supply-chain-attack
author: AII-Detector - ThreadLinqs Intelligence
date: 2026/09/18
tags:
    - attack.resource-development
    - attack.t1584
    - attack.initial-access
    - attack.t1195
    - attack.credential-access
    - attack.t1552
logsource:
    category: proxy
    product: null
detection:
    selection_domain:
        c-uri-host|endswith:
            - '.sendibt1.com'
            - 'sendibt1.com'
    selection_path:
        cs-uri-stem|contains:
            - '/f.js'
            - '/wm.zip'
    condition: selection_domain or selection_path
falsepositives:
    - None expected; sendibt1.com is not a legitimate Brevo domain
level: critical
```

**Known false positives:**

- None expected during the active incident window since sendibt1.com is attacker-registered infrastructure; if the domain is resold/repurposed after takedown, correlate against current WHOIS/DNS ownership before treating any future hit as benign.

**Tuning notes:** Feed the full cdn0-cdn11.sendibt1.com subdomain range plus the known file hashes into DNS/proxy blocklists and threat-intel watchlists; the actor may rotate to new cdn*.sendibt1.com subdomains or a new apex domain post-remediation, so refresh the domain list from active threat-intel feeds rather than hardcoding only the IOCs observed on 2026-09-14.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Brevo Supply-Chain: Malicious [indicator] Edge-Injected Script Load (locked: unlock with TL Creds)
- Web Media Optimizer Backdoored WordPress Plugin - mu-plugins Persistence Install (locked: unlock with TL Creds)
- Web Media Optimizer C2 Beaconing and ClickFix Backup-Infrastructure Callback (locked: unlock with TL Creds)
- Brevo Supply-Chain: Malicious [indicator] Edge-Injected Script Load (locked: unlock with TL Creds)
- Web Media Optimizer Backdoored WordPress Plugin - mu-plugins Persistence Install (locked: unlock with TL Creds)
- Web Media Optimizer C2 Beaconing and ClickFix Backup-Infrastructure Callback (locked: unlock with TL Creds)
- Web Media Optimizer Backdoored WordPress Plugin - mu-plugins Persistence Install (locked: unlock with TL Creds)
- Web Media Optimizer C2 Beaconing and ClickFix Backup-Infrastructure Callback (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 24)

Defanged, TLP:CLEAR.

- IP address: `172.246.243[.]65`
- Domain: `sendibt1[.]com`
- File hash: `fe8447fd1ec4dca652b71db2c749fcc24a5bec3875f3654042169fb2418aed09`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Brevo supply chain attack hits 100k+ sites with WordPress backdoors and ClickFix malware](https://sansec.io/research/brevo-supply-chain-attack)
- [Brevo Supply-Chain Attack Infected Over 100,000 Websites](https://securityaffairs.com/199355/hacking/brevo-supply-chain-attack-infected-over-100000-websites.html)
- [Brevo supply-chain attack injected ClickFix scripts on customer sites](https://www.bleepingcomputer.com/news/security/brevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites/)
- [Brevo Supply Chain Attack Injects Malware Into 100,000 Websites](https://www.securityweek.com/brevo-supply-chain-attack-injects-malware-into-100000-websites/)
- [Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack](https://www.securityweek.com/trezor-says-347000-users-received-phishing-emails-after-brevo-hack/)
- [Brevo hack: 100,000+ websites serve malware for hours in a supply chain attack](https://cybernews.com/security/brevo-supply-chain-attack-clickfix-malware/)
- [Hackers Turn Brevo Widgets Into Malware Delivery Channel Across 100,000+ Websites](https://gbhackers.com/brevo-widgets-supply-chain/)
- [Crypto customers targeted by scammers after email marketing provider breach](https://www.malwarebytes.com/blog/news/2026/09/crypto-customers-targeted-by-scammers-after-email-marketing-provider-breach)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2573