Brevo Supply Chain Attack Pushed ClickFix to Customer Sites

Brevo sells email marketing to businesses, and its script tags sit on a huge number of their websites: signup forms, live chat, tracking SDKs. On Monday 14 September 2026, those tags started pulling in malware. The Paris company's own ClickFix incident write-up traces the whole thing to a single credential. It was Brevo's second security incident in four days.

Key Takeaways

• Brevo says a long lived Cloudflare API key with full account permissions was stored in application source code, and the attacker used it to deploy a malicious Cloudflare Worker.
• Brevo's timeline puts impact between 15:01 and 20:30 UTC on 14 September 2026, roughly five and a half hours, while Sansec observed malware on customer sites from 16:05:18 to 20:12:53 UTC.
• Sansec estimates more than 100,000 customer websites loaded the poisoned Brevo scripts, including cdn.brevo.com/js/sdk-loader.js and cdn.brevo.com/js/brevo-conversations.js.
• Logged in WordPress administrators were served a backdoor plugin install, while ordinary visitors, including people clicking unsubscribe links in Brevo campaign emails, saw a ClickFix overlay.
• Brevo states that app.brevo.com, its API, email sending and customer account data were not affected.

How Did the Attackers Get Into Brevo?

They used a Cloudflare API key that Brevo had left hardcoded in its application code. According to BleepingComputer's report, the key carried full account permissions, which let the attacker create Workers, routes and DNS records across Brevo's zones without triggering an alert. Brevo believes the key may have been compromised as early as late August.

That date lines up with the infrastructure. Sansec found the attacker host cdn.sendibt1.com received its TLS certificate on 25 August 2026 at 17:08 UTC. The twist: sendibt1.com is a domain Brevo owns. The attacker simply added cdn through cdn11 subdomains to it, so the payload hosts looked like Brevo property because they were.

Brevo's own timeline for 14 September, all UTC:

• 14:23: attacker creates a hostname
• 14:28: Worker deployed and tested
• 14:42: Worker routed to brevo.com
• 15:01: impact begins
• 16:07: Worker updated and routed to sibforms.com
• 19:33: Brevo opens a security incident
• 20:30: malicious content removed
• 20:42: verification confirms pages clean

Note the gap. Impact ran for four and a half hours before anyone at Brevo opened a ticket.

What Did the Malicious Worker Change?

The Worker rewrote Brevo's responses at the edge and appended a loader to its JavaScript. Brevo lists brevo.com, sendinblue.com, its login, account, my and onboarding subdomains, sibforms.com, the forms script, the Conversations widget and the SDK loader as affected. The Sansec analysis names two modified files, cdn.brevo.com/js/sdk-loader.js and cdn.brevo.com/js/brevo-conversations.js, each extended with code that injected https://cdn2.sendibt1.com/f.js.

From there the payload split by audience:

• WordPress admins visiting their own site while logged in triggered a silent POST to /wp-admin/update.php?action=upload-plugin, installing a plugin from cdn10.sendibt1.com/p/wm.zip. BleepingComputer identified it as Web Media Optimizer, a backdoor that hides from the plugin list and copies itself into the must use plugins directory.
• Everyone else got a full page fake Cloudflare check followed by ClickFix instructions to run a command on Windows.

Sansec says the malware stayed dormant for crawlers, developers and automated scanners. Brevo explains why its own monitoring missed it: the Worker removed security headers such as Content-Security-Policy, and because origin files never changed, standard integrity checks saw nothing wrong.

How Does the ClickFix Step Work?

ClickFix tricks the victim into running the attacker's command themselves, so no exploit or download prompt is needed. MITRE catalogs it as T1204.004, Malicious Copy and Paste. In the Brevo case, Sansec reports that the page placed a command on the clipboard and told the visitor to paste and run it. Sansec's IOC list shows the choreography: a fingerprint POST to /api/v1/0044d4a, a proof of work token from /api/v1/e08a3c4, the clipboard command from /api/v1/4aff112?tk=, then an image beacon.

Neither Sansec nor Brevo has published the command itself or the malware it fetched. We would rather leave that blank than guess. The same social engineering, served from thousands of compromised sites through blockchain contracts, is covered in our look at the 5,400 site EtherHiding ClickFix campaign.

Why Email Users Should Care

Sansec describes the ClickFix overlay as shown to everyone browsing a customer site "or clicking an (unsubscribe) link in a Brevo-sent campaign email." The email itself was genuine. Brevo says sending was untouched, so the message would have looked and authenticated like any other campaign. The poisoned part was the page the link opened: Sansec points to Brevo hosted unsubscribe and form pages, and sibforms.com, where Brevo serves hosted forms, was one of the rewritten domains.

That is the uncomfortable lesson for anyone who manages an inbox. Every link in a marketing email already routes through the sender's vendor: Brevo rewrites campaign links to redirect through its click servers, as we documented in how Brevo tracks your email. Most of the time that detour only costs you privacy. When the vendor's edge is compromised, every page it serves becomes a delivery channel, and the unsubscribe page is one you cannot avoid by stripping trackers, since it lives on the vendor's domain by design. Brevo's incident report does not list its click redirect hosts as affected, and we found no evidence they were.

This also caps a rough week. On 10 September, a separate Brevo single sign on flaw let attackers take over customer accounts and send phishing from them, the incident behind the fake Trezor security alerts. Two unrelated failures, one abusing Brevo accounts and one abusing Brevo infrastructure, both ending with Brevo customers' audiences as the target.

Our Analysis: The Key Was the Whole Attack

Most coverage frames this as a ClickFix story. The more useful framing is credential scope. A single token that can create Workers, attach routes and write DNS turns one leak into control of the content layer for five apex domains Sansec lists: brevo.com, sibforms.com, sibautomation.com, sendinblue.com and sendibt1.com. Cloudflare's API token documentation supports scoping tokens to specific resources and adding client IP filtering and a TTL. Any of those would have narrowed this key's blast radius. Brevo says it has since moved secrets into HashiCorp Vault with automatic rotation and turned on Cloudflare audit alerting.

Edge rewriting also defeats the checks defenders usually trust. File integrity monitoring on the origin watched clean files the whole time. Customer sites were different: a site whose own CSP allowed cdn.brevo.com but not sendibt1.com would have refused the second stage loader, and Sansec's CSP monitor logged 2,549 violation reports across 12 sites during and after the window. That doesn't protect Brevo hosted pages like forms and unsubscribe screens, where Brevo's headers are the only ones in play.

What Should Site Owners Do Now?

Start by checking whether a WordPress admin browsed your site while logged in on 14 September. Sansec and Brevo recommend these steps:

1. Search access logs for POST /wp-admin/update.php?action=upload-plugin on 14 September, followed by /wp-admin/plugins.php?action=activate.
2. Compare the plugin folders on disk, including wp-content/mu-plugins, against what the admin screen shows. The backdoor hides from the list.
3. Remove anything installed that day, then rotate administrator passwords and any Brevo API keys.
4. Block or alert on *.sendibt1.com cdn subdomains, glegchner.com, yelahaye.surf, boiseno.club and corralos.beer in DNS and proxy logs.
5. Tighten your script-src CSP to exact vendor hosts. Consider Subresource Integrity for third party scripts, knowing it breaks whenever a vendor updates a loader in place, so it suits pinned versions better than evergreen ones like sdk-loader.js.

What Should Email Recipients Do?

If you pasted a command from a verification page on 14 September, Brevo's post incident guidance says to treat that computer as compromised, run an antivirus scan and change your passwords. Going forward:

• No real CAPTCHA ever asks you to open Run, Terminal or PowerShell. Close the tab.
• Prefer the List-Unsubscribe button Gmail shows next to the sender name over the link at the bottom of the email; for senders that support one click unsubscribe, Gmail sends the request without opening a web page.
• If you log in to Brevo yourself, change your password and review your API keys, as Brevo advises.

The malicious hosts stopped resolving on 15 September and Brevo's files are clean again. The key that made it possible sat in source code for weeks before anyone used it loudly.