Brevo Supply Chain Attack Serves ClickFix Malware to 100,000+ Websites via Hijacked Cloudflare CDN

The attack vector was a Cloudflare API key with full account permissions that Brevo had hardcoded directly in its application source code. Attackers obtained the key, which had no expiration date and no scope restrictions, and used it to authenticate to the Cloudflare API with the same access level as Brevo's own operations team.

With full API access, attackers created a malicious Cloudflare Worker, a serverless function that intercepts and modifies HTTP responses at the CDN edge before they reach the end user. The Worker targeted four Brevo-owned domains: brevo.com, sendinblue.com, login/account/my/onboarding.brevo.com, and sibforms.com. It modified the JavaScript served from those domains to inject malicious payloads before handing responses to the browser. Critically, the Worker also removed Content Security Policy headers from every response, disabling the browser-level protection that would normally block execution of scripts from unauthorized domains.

Origin servers at Brevo were never touched. Standard file integrity monitoring tools that watch for changes to server-side files produced zero alerts because the files never changed. Brevo's CDN logs recorded every malicious response, but without real-time alerting on Worker deployments or edge-layer anomaly detection, the attack ran undetected for approximately 5.5 hours between 16:05 and 20:30 UTC.

Sansec, a web security firm that specializes in e-commerce malware, detected the attack through behavioral anomaly signals in external site scans and published research showing more than 100,000 websites were likely exposed. Brevo confirmed the incident the following day, revoked the compromised API key, deleted the malicious Worker and associated routes, and removed attacker-controlled hostnames from its DNS records.

The root cause is the same pattern documented in supply chain attacks against software build pipelines: long-lived credentials with excessive permissions stored in source code, accessible to anyone who obtains a copy of that code through a repository leak, a compromised developer machine, or a third-party service breach.

Unauthenticated visitors to any of the more than 100,000 websites embedding a Brevo form or chat widget during the attack window encountered a full-screen overlay styled to mimic a Cloudflare browser verification page. The ClickFix technique has been observed in dozens of campaigns since early 2025 and relies on user compliance rather than any browser vulnerability.

The fake verification prompt instructed users to press Windows Key + R to open the Windows Run dialog, then paste a command from the clipboard that the malicious JavaScript had already placed there without any visible indicator. Users who followed the instructions executed attacker-supplied code with their own user-level Windows privileges. The ClickFix payloads in the Brevo attack delivered second-stage downloaders pointing to infrastructure at yelahaye.surf and corralos.beer/a412dkoq.js, though specific second-stage payload identification was not publicly confirmed at the time of writing.

Mac and Linux users visiting affected sites received the fake Cloudflare page but the ClickFix instructions are specific to Windows, reducing the impact on non-Windows users to a failed social engineering attempt rather than code execution.

For affected Windows users, the immediate remediation is to scan for any recently installed programs or scheduled tasks created around September 14, run an endpoint detection scan, and rotate any credentials that were active on the machine during the visit. If a user executed the ClickFix command, treat the machine as potentially compromised and initiate your standard incident response for endpoint malware.

The second payload targeted a specific high-value category of visitor: WordPress site administrators who were logged into their WordPress dashboard in the same browser session while visiting any Brevo-embedding page.

When the malicious Cloudflare Worker detected that a visitor had an active WordPress admin session, it injected JavaScript that silently sent two HTTP requests using the authenticated browser session. The first was a POST to /wp-admin/update.php?action=upload-plugin, uploading a malicious plugin archive named Web Media Optimizer from a Brevo-controlled distribution domain. WordPress treated this as a legitimate plugin upload because it originated from an authenticated admin session with a valid nonce token. The second request immediately activated the newly uploaded plugin via a GET to /wp-admin/plugins.php?action=activate. The sequence completed in under two seconds, producing no visible change in the WordPress dashboard.

Once active, the Web Media Optimizer backdoor took four immediate actions. It hid itself from the WordPress plugin listing by hooking the plugin display filter, making it invisible to administrators reviewing the Plugins page. It copied itself to /wp-content/mu-plugins/, the must-use plugins directory that WordPress loads automatically on every request regardless of which plugins are activated or deactivated. It stored a hardcoded authentication key that generates a valid WordPress administrator session without requiring the account password, giving attackers persistent login capability even if all passwords are rotated. Finally, it established a command-and-control beacon to glegchner.com/ads.php for instructions.

The backup JavaScript URL mechanism described in Sansec's research means the backdoor can fetch a new C2 address if the primary domain is taken down, adding resilience to the persistence mechanism.

The following indicators cover the malicious CDN infrastructure, C2 domains, WordPress backdoor file hash, and HTTP request patterns associated with the September 14, 2026, attack. For WordPress administrators, the request pattern indicators are the most actionable: search your access logs for the plugin upload sequence and verify whether your site was targeted before the malicious Worker was removed.

Web Media Optimizer backdoor SHA-256: f359ab0d2f732b54dd3300065f4d6553f4df1b67454b71fd81197e26f02af4a8. Run find /var/www -name '*.php' -newer /etc/hostname to surface recently modified PHP files, then hash-check against this value. Check /wp-content/mu-plugins/ specifically, as the backdoor copies itself there for persistence even after the primary plugin directory entry is deleted.

These rules detect the WordPress backdoor installation sequence and C2 beacon traffic associated with the Brevo supply chain attack. Both carry experimental status; validate against your web server and proxy log formats before enabling automatic blocking.

The Brevo attack follows the same structural pattern as multiple recent supply chain incidents that targeted developer and marketing infrastructure: JFrog Artifactory's three-CVE backdoor chain that hit 51 percent of exposed instances and the credential exposure pathway documented in the GitLab path traversal attack that exposed credentials from customer pipelines. In each case, the attacker's leverage point was not a flaw in the end organization's security controls but a compromise of a shared service that those organizations trusted implicitly.

The CDN supply chain attack surface is particularly dangerous because the trust relationship is completely invisible to most organizations. A company that embeds a Brevo form widget has no way to inspect Brevo's Cloudflare account permissions, no ability to enforce Subresource Integrity on dynamically served scripts unless they control the embed code, and no mechanism to detect that the JavaScript they are serving changed at the CDN edge without touching any file on their origin server.

Three controls that would have prevented or dramatically limited the Brevo attack: First, Subresource Integrity (SRI) attributes on all third-party script tags. SRI causes the browser to hash-verify the downloaded script against a known value and refuse to execute it if the hash mismatches. An SRI-protected Brevo widget would have caused the browser to reject the modified script silently and simply not load the widget. Second, a strict Content Security Policy that explicitly lists permitted JavaScript execution origins. Even without SRI, a CSP that blocked execution of scripts from cdn10.sendibt1.com and the other attacker-controlled domains would have prevented both payloads from running. Third, short-lived, scoped API keys for all infrastructure services. A Cloudflare API token scoped only to cache purge and analytics operations cannot create Workers or modify routes, regardless of how it is obtained.

The market reality is that most marketing and analytics widgets are embedded without any integrity protections because the vendors explicitly want to serve dynamic, updateable JavaScript. Organizations that rely on these services are accepting implicit trust in the vendor's CDN security posture.

Remediation requires four distinct tracks: WordPress audit, endpoint response for ClickFix victims, CDN configuration hardening, and API key hygiene.

For WordPress sites that embed any Brevo, Sendinblue, or sibforms widget, complete every step in the WordPress track before considering the site clean. Patching Brevo's CDN configuration does nothing to remove a backdoor already installed on your WordPress server.

For end users who visited a Brevo-embedding site and may have followed the ClickFix instructions, treat the affected Windows machine as potentially compromised. The ClickFix payload installs a second-stage downloader and Brevo has not publicly confirmed whether credential-harvesting or ransomware deployment was the final payload in all observed cases.