Brevo has disclosed that threat actors obtained a Cloudflare API key and leveraged it to deploy malicious ClickFix scripts through its content delivery network, affecting both its own properties and JavaScript libraries that thousands of customer websites rely on. The customer relationship management and digital marketing platform stated that the attackers used the stolen credential to construct a Cloudflare Worker capable of altering content at the edge, keeping the compromise active for approximately five and a half hours on September 14.
The injection campaign touched multiple Brevo domains including brevo.com, sendinblue.com, login/account/my/onboarding.brevo.com, and sibforms.com. The malicious Worker also tampered with the Brevo forms script, Brevo Conversations widget, and the Brevo SDK loader—all components that customers embed directly into their own web properties.
In a detailed post-mortem, Brevo revealed that the attackers had obtained a long-lived Cloudflare API key containing full account permissions that had been embedded directly in application source code. This configuration allowed the threat actors to create Cloudflare Workers, routes, and DNS records across Brevo's zones without setting off any alerts.
Because the Worker rewrote responses at the edge and removed security headers such as Content-Security-Policy, our origin servers and files remained unmodified and standard integrity checks did not detect the change
Brevo
Brevo indicated the API key may have been compromised as far back as late August, though no evidence of malicious use prior to the September 14 attack has surfaced. Once the compromise was discovered, the company removed the Worker and its routes, narrowing the exposure window to between 16:07 and 20:30 UTC.
The remediation steps that followed included revoking the compromised key and any credentials generated with it, stripping the hardcoded credential from source code, eliminating attacker-controlled hostnames, and flushing edge caches. Brevo stated that app.brevo.com, its API endpoints, email delivery systems, and customer account information remained unaffected.
Scope and ClickFix Distribution
Security researcher Sansec first identified the incident and estimated it may have impacted as many as 100,000 websites running the compromised Brevo components. Sansec documented the attack window as September 14, 2026, between 16:05 and 20:13 UTC, and confirmed that all malicious subdomains had stopped resolving by September 15, with Brevo files returning to a clean state.
Site visitors encountered a counterfeit Cloudflare verification page followed by ClickFix prompts instructing them to execute commands on Windows systems. On WordPress installations using an affected Brevo widget, the injected code performed additional reconnaissance—checking whether the visitor held administrator credentials and attempting to download a malicious plugin package from https://cdn10.sendibt1[.]com/p/wm.zip.
Although Sansec could not obtain the archive, BleepingComputer retrieved a copy from VirusTotal. The file masquerades as a WordPress plugin called "Web Media Optimizer" but functions as a persistent backdoor and script injector. Additional distribution points for the malicious plugin and related payloads included https://yelahaye[.]surf and https://boiseno[.]club.
Once activated, the plugin conceals itself from the WordPress plugin management interface, copies itself into the must-use plugins directory to ensure persistence across updates, and regularly communicates with an attacker-controlled server at https://glegchner.com/ads.php. That endpoint currently returns a Base64-encoded URL that decodes to https://corralos[.]beer/a412dkoq.js, which the plugin injects to deliver ClickFix lures to site visitors.
The malicious code includes a failsafe mechanism: it stores a backup copy of the last known valid JavaScript URL, allowing continued payload delivery if the primary command-and-control server becomes unavailable. Additionally, the plugin contains a hardcoded authentication token that permits attackers to forge valid WordPress administrator sessions without requiring the actual account password.
Connection to Earlier SSO Breach Unclear
On September 10, Brevo disclosed a separate incident involving single sign-on systems, where attackers gained unauthorized access to customer accounts and initiated phishing campaigns targeting users of companies relying on Brevo's platform. Trezor, a cryptocurrency hardware wallet manufacturer, reported on September 11 that phishing messages reached 347,000 user addresses, with confirmed compromises affecting at least 2,500 accounts.
Brevo declined to address whether the SSO compromise and the Cloudflare API key theft were connected or part of a coordinated campaign.
Recommended Actions
WordPress administrators who were logged into their accounts while visiting an affected site on September 14 should review their plugin inventory for any unfamiliar or newly activated extensions from that date and delete them. If suspicious plugins are discovered, administrators should immediately change their WordPress administrator passwords.