Brevo Supply Chain Attack: Compromised Cloudflare API Key Injected ClickFix Malware Into 100,000 Websites
Brevo Supply Chain Attack: Compromised Cloudflare API Key Injected ClickFix Malware Into 100,000 Websites
Customer engagement platform Brevo has disclosed a supply chain attack that resulted in malicious code being injected into more than 100,000 websites — a two-stage intrusion that began with a vulnerability in Brevo's handling of SAML SSO and returned four days later through a stolen long-lived Cloudflare API key.
According to Brevo's incident notice and post-mortem, the attackers first struck on September 10, exploiting the SAML SSO vulnerability to access 138 accounts, including one belonging to cryptocurrency storage provider Trezor. They sent phishing emails from six of the accounts and exported the contacts of 43. Brevo closed the unauthorized access — but the attackers came back on September 14, using a compromised long-lived Cloudflare API key to deploy a worker that injected malicious scripts into brevo.com, sibforms.com, and three JavaScript files that Brevo's customers embed into their websites.
The injected script showed selected visitors a fake "Cloudflare, verify you are human" page instructing them to paste and run a command on their computer — the social-engineering technique known as ClickFix. On WordPress websites embedding a Brevo widget, the script attempted to deploy and run a plugin if the visitor was logged in as an administrator.
Five and a Half Hours, 100,000 Sites
The malicious worker was active for roughly five and a half hours before Brevo removed it and revoked the compromised key and credentials. Brevo's investigation found the Cloudflare key was first misused in late August 2026, though no customer-facing content was injected before September 14. E-commerce security firm Sansec assessed the malware was served for about four hours and that more than 100,000 websites were likely impacted.
"Brevo is no longer serving malicious code. However, your WordPress site may have been backdoored, and your customers may have fallen for the ClickFix scam," Sansec warned.
What Should You Do?
- If your site embeds Brevo forms or widgets, audit it now. Check for unauthorized plugin installations, unknown administrator accounts, and unfamiliar scripts — the injection is over, but a backdoor planted during the window could persist.
- Rotate long-lived API keys, especially edge and CDN keys. A single Cloudflare API key that could deploy a worker sat exposed from late August; any key that can change what your site serves deserves a short lifetime and scoped permissions.
- Check SSO handling and audit logs. The initial breach came through SAML SSO abuse — review identity-provider audit logs for sessions you cannot explain, and force credential resets on affected accounts.
- Warn users who saw fake verification prompts. Anyone who pasted and ran a command from a "verify you are human" page should scan their machine for malware — ClickFix payloads typically execute attacker-controlled scripts directly.
The WAF Angle
This attack is the definitive case study in why third-party JavaScript is a supply chain your WAF cannot vouch for. Brevo's embedded scripts were legitimate for years — right up until a stolen API key made a Cloudflare Worker rewrite them into a credential-stealing trap. Defenders should internalize three things. First, script integrity controls (CSP with SRI, tight script allowlists, and change monitoring on third-party file contents) are the only web-layer answer to a trusted origin turning hostile. Second, the payload weaponized the administrator session: the script probed whether a WordPress visitor was logged in as admin before attempting plugin deployment — meaning client-side context is now attack input, and admin sessions should never be treated as invisible. Third, the kill chain ran entirely through control planes a WAF never inspects: an SSO flaw and an API key. Your Content Security Policy, your key rotation schedule, and your IdP audit logs are, functionally, part of your web application firewall strategy.
