Brevo Supply Chain Attack Injects ClickFix Malware Into 100,000 Websites

A major supply chain attack targeting customer engagement platform Brevo has resulted in malicious script injection across more than 100,000 websites. The attackers compromised Brevo’s infrastructure using a combination of SAML SSO vulnerabilities and a long-lived Cloudflare API key, leveraging edge workers to serve ClickFix social-engineering prompts and backdoor WordPress administration panels.

The compromised assets included primary domains brevo.com and sibforms.com, along with three JavaScript files widely embedded into customer websites. Cybersecurity firm Sansec reported that the malicious payload was actively served to web traffic for approximately four hours before Brevo removed the worker and revoked the compromised credentials.

Attack Chain: From SAML SSO Vulnerability to Cloudflare API Compromise

The security incident occurred in two distinct phases starting in early September. On September 10, threat actors initially breached Brevo by exploiting a vulnerability in the platform’s handling of SAML (Security Assertion Markup Language) Single Sign-On (SSO). SAML authentication flaws typically involve improper XML signature validation or session token handling, allowing unauthorized actors to forge assertions or hijack user sessions.

Through this vector, the attackers accessed 138 Brevo accounts, including one belonging to cryptocurrency storage provider Trezor. The threat actors exported contact lists from 43 accounts and used six compromised accounts to send phishing emails. While Brevo terminated this initial access shortly after discovery, the attackers had already harvested broader access credentials within the environment.

On September 14, the attackers re-entered the environment using a compromised long-lived Cloudflare API key. According to Brevo’s post-mortem analysis, investigation records indicate the key was first misused in late August 2026, pointing to persistent access prior to active payload deployment.

Edge Worker Hijacking and the ClickFix Technique

Using administrative permissions provided by the stolen Cloudflare API key, the attackers deployed a malicious Cloudflare Worker. Serverless edge workers run JavaScript code directly on CDN edge nodes, intercepting incoming HTTP traffic before requests reach origin servers. This architecture allows attackers to manipulate response bodies in real time, injecting arbitrary code into dynamic assets like sibforms.com without modifying static files stored on primary application servers.

Because edge-based script injection bypasses standard origin-level file integrity monitoring (FIM) and Web Application Firewalls (WAFs) looking at backend code repositories, the injected code was served seamlessly to end visitors loading embedded Brevo forms or widgets.

The injected worker modified three client-side JavaScript scripts to perform two distinct functions depending on visitor privileges:

1. The ClickFix Social-Engineering Scam: For standard website visitors, the script rendered a fake overlay prompting users with a message reading “Cloudflare, verify you are human.” The ClickFix attack pattern relies on human interaction rather than traditional software exploitation: the prompt automatically copies an obfuscated PowerShell or terminal command to the user’s clipboard and instructs them to open their system’s command prompt or Run dialog to execute it. Running this command executes malicious code directly on the host operating system, entirely bypassing browser security sandboxes.

2. Automated WordPress Admin Backdooring: If the script detected that the visitor was logged into an affected website as a WordPress administrator, it initiated background HTTP requests directly against the site’s administrative dashboard (/wp-admin). Utilizing the administrator’s active session authentication, the script automatically uploaded, installed, and activated a backdoored WordPress plugin without requiring manual interaction from the site owner.

Blast Radius and Affected Platforms

Brevo (formerly Sendinblue) provides marketing automation, email delivery, and embeddable forms utilized globally across e-commerce, corporate, and publishing platforms. Because third-party tracking scripts and embeddable form builders inherit execution rights within the browser context of the host site, the blast radius was immediate.

Sansec estimates that more than 100,000 unique domains served the malicious code during the four-hour operational window. The total lifetime of the malicious Cloudflare Worker was roughly five and a half hours before Brevo fully contained the threat.

Remediation and Recommended Actions

Brevo confirmed that it has mitigated the incident by removing the malicious Cloudflare Worker, revoking all impacted API keys and credentials, and resolving the underlying SAML SSO implementation issue. However, downstream site administrators and security operations teams must perform secondary remediation to verify site and endpoint integrity:

• Audit WordPress Installations: Website administrators using Brevo widgets or plugins should inspect /wp-admin/plugins.php for unauthorized or newly added plugins installed on or around September 14. Administrators should also review database tables (wp_options and wp_users) for suspicious administrative accounts or modified configuration settings.
• Inspect Client Endpoints: Any end user who encountered a “verify you are human” prompt on a site hosting Brevo scripts should be audited for endpoint compromise. Security analysts should review system process logs (e.g., Windows Event ID 4688 or PowerShell Operational Event ID 4104) for unauthorized instances of powershell.exe, cmd.exe, or mshta.exe executing encoded script blocks.
• Review Third-Party Script Dependencies: Organizations should assess their reliance on unpinned external JavaScript libraries and evaluate Subresource Integrity (SRI) hashing or restrictive Content Security Policies (CSP) to limit where dynamic scripts can execute and fetch external dependencies.