Customer engagement platform Brevo suffered a supply chain attack that resulted in malicious JavaScript being distributed through resources embedded across more than 100,000 websites, turning the company’s infrastructure into a large-scale malware delivery mechanism.
The incident began on September 10, when attackers exploited a vulnerability in Brevo’s handling of SAML single sign-on (SSO). The attackers gained access to 138 customer accounts, including an account belonging to cryptocurrency hardware wallet company Trezor. They subsequently exported contacts from 43 accounts and used six compromised accounts to distribute phishing emails.
Brevo initially contained that intrusion, but the attackers still possessed another valuable credential.
A Cloudflare API Key Opened the DoorOn September 14, the attackers returned using a compromised long-lived Cloudflare API key.
They used the credential to deploy a malicious Cloudflare Worker capable of modifying content delivered through Brevo’s infrastructure. The worker injected malicious scripts intobrevo.com,sibforms.com, and three JavaScript files commonly embedded by Brevo customers on their own websites.
This transformed the incident from a breach of Brevo itself into a supply chain attack.
Websites did not necessarily need to be individually compromised. Simply loading the affected Brevo JavaScript could expose visitors to attacker-controlled content.
Security firm Sansec estimates that more than 100,000 websites were potentially affected.
Visitors Were Targeted With ClickFixThe injected malware selectively displayed a fake Cloudflare “Verify you are human” page.
Instead of completing a normal CAPTCHA, victims were instructed to copy and execute a command on their computers.
This technique is known as ClickFix and has become increasingly common in malware campaigns. Rather than exploiting a vulnerability in the victim’s browser, attackers socially engineer users into executing the malicious command themselves.
The approach can bypass some conventional browser security controls because the final execution is performed by the victim.
The malicious script did not necessarily appear to every visitor, making the compromise harder to detect through simple website checks.
WordPress Administrators Faced an Additional ThreatWordPress sites using Brevo widgets faced another attack path.
If the malicious script detected that a visitor was already logged into WordPress as an administrator, it attempted to install and execute a malicious plugin.
This means that removing the compromised Brevo JavaScript does not necessarily eliminate the threat.
A WordPress site successfully targeted during the incident could remain backdoored even after Brevo stopped distributing the malicious code.
Brevo says the malicious Cloudflare Worker remained active for roughly five and a half hours before the company removed it and revoked the compromised API key and associated credentials. Sansec estimates malicious code was actively served for roughly four hours.
The API Key Had Been Compromised EarlierBrevo’s investigation indicates that the Cloudflare API key had actually been misused as early as late August 2026.
However, the company says it found no evidence that malicious content was injected into customer-facing pages before September 14.
The timeline illustrates the danger associated with long-lived infrastructure credentials.
An attacker who steals an API key may retain access long after the original intrusion appears to have been contained. If that credential controls infrastructure responsible for distributing code to customers, the consequences can extend far beyond the compromised company itself.
Websites Still Need to Be CheckedBrevo is no longer distributing the malicious code, but organizations using its services may still need to investigate their environments.
Website administrators should look for unauthorized WordPress plugins or other unexpected modifications made during the attack window. Visitors who encountered the fake Cloudflare verification page and executed the requested command should treat their computers as potentially compromised and perform a malware investigation.
The Brevo incident demonstrates why third-party JavaScript represents an important part of the modern software supply chain.
A website may have secure servers, patched applications, and strong authentication while still executing code hosted by external providers. Compromising one of those providers can give attackers a distribution channel reaching thousands of otherwise unrelated organizations simultaneously.
In this case, a stolen infrastructure credential allowed attackers to turn a legitimate marketing platform into a malware delivery network capable of reaching more than 100,000 websites in only a few hours.