Brevo Supply Chain Attack: 100K Sites Served ClickFix

Brevo Supply Chain Attack: 100K Sites Served ClickFix | 2026

Executive Summary

Brevo faced a supply-chain incident on September 14, 2026, after attackers abused a long-lived Cloudflare API key to inject malicious JavaScript into Brevo-owned pages and customer-embedded scripts. Sansec reported that more than 100,000 websites may have loaded affected Brevo assets during a roughly four-to-five-hour window. Brevo later confirmed, according to BleepingComputer, that the compromised key had full account permissions and had been hardcoded in application source code.

The attacker used Brevo's trusted script delivery path to show fake Cloudflare verification prompts and attempt WordPress plugin installation when logged-in administrators visited affected sites. For defenders, the lesson is blunt: third-party JavaScript is production code, and cloud edge credentials can become a mass distribution channel for malware.

What happened?

• August 25, 2026: Sansec observed the creation of cdn.sendibt1.com, later associated with the malicious infrastructure.
• September 10, 2026: Brevo disclosed a separate SSO-related incident affecting six customer accounts. Brevo had not publicly linked that incident to the Cloudflare compromise at the time of reporting.
• September 14, 2026, around 16:05 UTC: Sansec observed Brevo assets serving an injected script that loaded malware from attacker-controlled sendibt1.com subdomains.
• September 14, 2026, 16:07-20:30 UTC: Brevo's later account, reported by BleepingComputer, placed the exposure window at roughly five and a half hours.
• September 15, 2026: Sansec reported that malicious hosts stopped resolving and affected files were clean at origin.
• September 16, 2026: Sansec published its analysis, estimating more than 100,000 potentially affected customer sites.
• September 17, 2026: BleepingComputer reported Brevo's post-mortem details, including the hardcoded Cloudflare API key, Cloudflare Worker abuse, and the response actions.

The important technical detail is that the origin files did not need to change. Brevo said the attacker used Cloudflare edge capabilities to rewrite responses, create routes, and add DNS records. That matters because ordinary origin-file integrity checks may miss edge-side manipulation.

Who is affected?

The most likely affected organizations are websites that embedded Brevo forms, the Brevo Conversations widget, or Brevo SDK loader scripts during the September 14 exposure window. Sansec specifically pointed to Brevo-hosted pages and customer sites that loaded:

• https://cdn.brevo.com/js/sdk-loader.js
• https://cdn.brevo.com/js/brevo-conversations.js
• Brevo-hosted forms on sibforms.com
• Brevo-owned pages such as brevo.com and related domains

WordPress administrators have a second exposure path. If an administrator was logged in while loading an affected page, the script reportedly attempted to upload and activate a plugin from attacker-controlled infrastructure. Sansec could not recover the plugin, but BleepingComputer later reported that a sample named "Web Media Optimizer" acted as a persistent backdoor and JavaScript loader.

End users who saw a fake Cloudflare verification page and followed its paste-and-run instructions should be treated as potentially compromised. That behavior fits the ClickFix pattern: a social engineering flow that convinces victims to execute a command locally under the pretense of completing a security check.

Initial access and kill chain

The currently supported chain is a cloud control-plane compromise rather than a direct compromise of every downstream website.

Phase	Observed behavior	Defender takeaway
Initial access	Brevo said attackers obtained a long-lived Cloudflare API key with full account permissions.	Long-lived edge/CDN keys should be treated as tier-zero credentials.
Control-plane abuse	Attackers created Cloudflare Workers, routes, and DNS records across Brevo zones.	Monitor control-plane changes with the same urgency as production code deploys.
Payload delivery	Brevo scripts and pages loaded malicious JavaScript from sendibt1.com subdomains.	Third-party scripts need runtime allowlisting and drift detection.
Execution	Visitors were shown ClickFix instructions telling them to run commands.	Browser-side social engineering can become endpoint execution.
Persistence	Logged-in WordPress admins were targeted with a plugin installation flow.	Admin browsing sessions can trigger server-side persistence attempts.
Command and control	BleepingComputer reported plugin callbacks to attacker-controlled infrastructure.	Hunt for both initial script loads and later plugin-based traffic.

MITRE ATT&CK mapping should remain conservative:

Tactic	Technique	Why it applies
Initial Access	Trusted Relationship / Supply Chain Compromise	Customers loaded scripts from a trusted marketing provider.
Defense Evasion	Impair Defenses	Brevo said the Worker removed security headers such as Content-Security-Policy.
Execution	User Execution	ClickFix relies on persuading users to run commands.
Persistence	Server Software Component	The WordPress path attempted plugin installation.
Command and Control	Web Service	Reported plugin behavior contacted attacker-controlled web endpoints.

Indicators and detection

Start with the September 14, 2026 window, then widen if logs show suspicious cache hits or delayed client activity.

Web and CDN logs

Look for requests to suspicious sendibt1.com subdomains and payload paths:

• cdn.sendibt1.com
• cdn2.sendibt1.com
• cdn3.sendibt1.com
• cdn4.sendibt1.com
• cdn9.sendibt1.com
• cdn10.sendibt1.com
• cdn11.sendibt1.com
• /f.js
• /api/v1/0044d4a
• /api/v1/e08a3c4
• /api/v1/4aff112?tk=
• /api/v1/b832c14?e=

Do not block the apex sendibt1.com blindly. Sansec warned that the apex is used for legitimate Brevo email tracking, while the malicious activity was associated with subdomains.

WordPress logs

Search for plugin upload and activation activity around the exposure window:

• POST /wp-admin/update.php?action=upload-plugin
• GET /wp-admin/plugins.php?action=activate
• New or hidden plugin directories created on September 14
• A plugin named Web Media Optimizer
• Unexpected files under wp-content/mu-plugins/

Endpoint and EDR

Prioritize endpoints whose users reported fake Cloudflare verification prompts. Hunt for:

• Browser-spawned PowerShell, cmd.exe, mshta, wscript, cscript, Terminal, or shell processes
• Clipboard-driven command execution shortly after visiting an affected website
• New persistence entries created after a browser session
• Malware alerts linked to ClickFix-style lures

Identity and cloud control plane

For organizations operating similar infrastructure, review:

• Long-lived API keys with broad permissions
• Cloudflare Worker, route, DNS, or Snippet creation by unexpected principals
• Control-plane changes that did not map to a deployment ticket
• Secrets stored in source code, build configs, or application config files

Example Splunk pattern

index=web OR index=proxy earliest="09/14/2026:16:00:00" latest="09/15/2026:00:00:00"
("cdn*.sendibt1.com" OR "sendibt1.com/f.js" OR "/api/v1/4aff112" OR "/api/v1/b832c14")
| stats count min(_time) as firstSeen max(_time) as lastSeen by src_ip, user, host, url
| convert ctime(firstSeen) ctime(lastSeen)

Treat this as an example pattern. Field names and wildcard behavior vary by proxy, SIEM, and log normalization.

Containment and remediation checklist

Immediate containment (0-24h)

• Identify whether your site loaded Brevo forms, chat widgets, or SDK scripts on September 14, 2026.
• Search web, CDN, and proxy logs for malicious sendibt1.com subdomains.
• Review WordPress admin logs for plugin upload or activation events during the incident window.
• Compare the WordPress plugin directory on disk against the admin UI; hidden plugins may not appear in the dashboard.
• Inspect wp-content/mu-plugins/ for unexpected persistence.
• Ask users who saw a fake Cloudflare verification prompt to stop using the affected endpoint and run an EDR or antivirus scan.
• Rotate WordPress administrator passwords where suspicious plugin activity is found.
• Preserve logs before cache rotation removes the incident window.

Hardening (24-72h)

• Replace long-lived cloud provider API keys with scoped, short-lived tokens where possible.
• Audit Cloudflare Workers, routes, DNS records, and Snippets for unauthorized changes.
• Add alerting for edge-response rewriting and security-header removal.
• Enforce Content-Security-Policy with reporting, but remember that a compromised edge layer can tamper with headers.
• Inventory externally hosted scripts and map them to business owners.
• Add subresource integrity where feasible, understanding that dynamic scripts may require a different control.
• Require change tickets or signed deployment metadata for control-plane modifications.

Longer-term controls (1-4 weeks)

• Move secrets out of source code and static configuration files.
• Build runtime monitoring for third-party JavaScript changes, not only vendor assurance checks.
• Segment cloud control-plane permissions so a single key cannot write DNS, Workers, routes, and cache behavior across unrelated zones.
• Add browser and endpoint detections for ClickFix execution patterns.
• Run tabletop exercises where a trusted SaaS script becomes malicious.
• Define emergency kill-switches for third-party scripts on high-risk pages.
• Review vendor security questionnaires for edge/CDN credential scope, rotation, and monitoring practices.

Strategic analysis: what this signals

The Brevo incident is a clean example of supply-chain amplification. Attackers did not need to compromise 100,000 individual sites. They targeted a provider whose JavaScript was already trusted by customers, then used a cloud edge control plane to modify what users received.

That should change how teams think about SaaS widgets, marketing tags, chat components, and analytics loaders. These scripts often run on checkout pages, account portals, lead forms, and admin sessions. They sit at a sensitive intersection of browser trust, identity, customer data, and business operations.

The incident also shows why secret-management failures are rarely just "developer hygiene" issues. A hardcoded, full-permission Cloudflare key became a production attack primitive. Short-lived tokens, least privilege, secret scanning, and control-plane alerting are not paperwork; they are blast-radius controls.

Finally, the WordPress plugin path is especially concerning. If confirmed in a given environment, this moves the incident from transient visitor exposure into persistent site compromise. Site owners should not stop after verifying that Brevo's scripts are now clean. They need to check whether their own application state changed while the malicious script was active.

References

1. Sansec: Brevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malware
2. BleepingComputer: Brevo supply-chain attack injected ClickFix scripts on customer sites