Executive Summary
On September 14, 2026, Brevo (formerly Sendinblue) was hit by a CDN-edge supply-chain compromise. An attacker used a stolen long-lived Cloudflare API key—hardcoded in Brevo application source with full account permissions—to deploy a malicious Cloudflare Worker that rewrote CDN-edge responses and injected a ClickFix social-engineering script into Brevo pages and three JavaScript files customers embed on their own sites. Origin servers and files were unmodified; tampering occurred at the CDN edge, and the Worker also removed security headers such as CSP.
Per Brevo’s post-mortem, the overall Worker impact window was approximately 15:01–20:30 UTC on 2026-09-14 (~5h29). Customer-embedded JavaScript and sibforms.com were affected from 16:07 UTC until 20:30 UTC, with independent clean verification at 20:42 UTC. Sansec estimates 100,000+ customer websites embedding affected Brevo components were in the blast radius; Brevo does not publish a site count, and blast radius is not equal to confirmed infections.
Brevo states app.brevo.com, the Brevo API, email sending, and customer account data held in Brevo were not affected. The malicious Worker/routes were removed, the compromised key and derived credentials revoked, attacker hostnames deleted, and edge caches purged. Status: resolved; hardening ongoing. There is no CVE assigned and this event is not in CISA KEV—it is credential/CDN account abuse, not a catalogued product CVE.
A related but separate Brevo SAML SSO org-boundary incident on 2026-09-10 (138 accounts accessed) has not been confirmed by Brevo as linked to the Cloudflare key theft. Do not merge the two without evidence.
Technical Information
Attack path (Brevo post-mortem):
- Stolen Cloudflare API key (hardcoded, full account permissions) first misused in late August 2026; Brevo reports no customer-facing malicious injection before September 14.
- Attacker created hostnames on Brevo-owned domains, deployed a Cloudflare Worker, tested on low-traffic domains, then routed the Worker to brevo.com (impact begins 15:01 UTC).
- Worker updated to append a loader to three embedded JS files and routed to sibforms.com (16:07 UTC), opening the customer-site blast radius.
- Fake full-screen “Cloudflare, verify you are human” ClickFix page; selective display; instructs Win+R → Ctrl+V → Enter; clipboard command downloads malware onto Windows. On WordPress sites with Brevo widgets, if the visitor was a logged-in admin, the script attempted silent plugin install/activate.
Containment (Brevo): incident opened 19:33 UTC; injection stopped 20:30 UTC; clean verification 20:42 UTC; subsequent hostname deletion and cache purge. Sansec reported malicious subdomains stopped resolving on 2026-09-15.
Primary Brevo and major news coverage describe behaviors in prose and do not publish MITRE ATT&CK technique IDs. This advisory does not invent ATT&CK mappings or APT attribution. Brevo has not confirmed a named threat actor or a link between the SSO incident and the Cloudflare key theft.
Affected Product Versions
N/A — No product version numbers. This is live CDN-served script integrity during a time window, not a versioned software CVE.
Affected surfaces (Brevo authoritative):
- brevo.com, sendinblue.com, login/account/my/onboarding.brevo.com
- sibforms.com and the Brevo forms script
- Brevo Conversations widget
- Brevo SDK loader
ClickFix active on those URLs from 16:07–20:30 UTC (Brevo); overall Worker impact from 15:01 UTC.
Customer-embeddable assets named in secondary reporting (align with Brevo’s “three JS files”): cdn.brevo.com / sdk-loader.js; brevo-conversations.js / Conversations widget; Brevo forms / sibforms.com. Also cited secondarily: sibautomation.com, conversations-widget.brevo.com, meet.brevo.com.
Infrastructure note: sendibt1.com is a legitimate Brevo-owned domain (email tracking); attacker created cdn* subdomains under Brevo Cloudflare control. Blocking the apex may break legitimate tracking.
Not affected (Brevo): app.brevo.com; Brevo API; email sending pipeline; stored customer account data inside Brevo.
Remediation for customers is not a software patch version—Brevo completed Worker removal, cache purge, and key revoke. Residual risk is end-user machines that ran ClickFix and WordPress sites that may still host malicious plugins after edge cleanup.
Workaround and Mitigation
Brevo completed (per post-mortem): removed malicious Worker/routes/hostnames; revoked compromised API key and credentials created with it; reviewed Cloudflare account members/credentials; purged edge caches; verified clean content; removed hardcoded credential from source; replaced with narrowly scoped short-lived tokens.
Brevo hardening in progress: HashiCorp Vault for Cloudflare keys/tokens + rotation; alerting on Cloudflare audit events; streaming Cloudflare logs to security monitoring; integrity protection for versioned embedded assets where possible; external scanning for injected content; review of third-party edge configs.
Customer actions (Brevo asks + TPRM operationalization):
- Inventory production sites that load Brevo/Sendinblue CDN scripts (sdk-loader, Conversations, sibforms, tracking).
- If anyone ran the pasted ClickFix command → treat the machine as compromised: disconnect, full AV scan, change passwords (start with Brevo).
- WordPress + Brevo scripts + admin visited site on 2026-09-14 while logged in → check plugins installed/activated that day (including mu-plugins); remove unexpected plugins; change admin passwords. Hunt POST /wp-admin/update.php?action=upload-plugin on that day.
- If logged into Brevo via brevo.com on 2026-09-14 → change password; review API keys.
- Conversations widget, SDK, and forms are safe to use after Brevo’s cleanup per Brevo (never modified at origin)—still verify your embeds and residual site compromise.
- Control design going forward: Subresource Integrity / CSP / script allowlists for third-party marketing tags; least-privilege vendor secrets; contractual notice SLAs for CDN/edge credential incidents.
- Keep a separate risk-register entry for the 2026-09-10 SSO account-takeover path versus this CDN supply-chain path—do not merge without evidence.
Indicators of Compromise
No CVE/KEV IoC package exists. File hashes are not reproduced here (Sansec primary IoC table was not retrieved in the OSINT pack; BleepingComputer referenced VT samples without publishing hashes in the fetched article text). Honest empty for file hashes.
Disclosed public artifacts (defanged; from Brevo guidance and reputable secondary reporting only—do not fetch live payload URLs):
- Plugin name: Web Media Optimizer; copies to wp-content/mu-plugins/; hides from plugin list (BleepingComputer / techhelp / byteiota)
- Historical plugin archive path: cdn10.sendibt1[.]com/p/wm.zip (BleepingComputer / Sansec via BC)
- C2 / beacon reported: glegchner[.]com / glegchner[.]com/ads.php
- Related domains reported: yelahaye[.]surf, boiseno[.]club, corralos[.]beer
- Abused Brevo domain pattern: cdn*.sendibt1[.]com (apex is legitimate Brevo tracking)
- Loader name (secondary): f.js
- Log hunt: POST /wp-admin/update.php?action=upload-plugin on 2026-09-14; plugin activate
Do not invent ATT&CK IDs or additional IoCs beyond sourced disclosures.
References
- Brevo status post-mortem (ClickFix / CDN Worker), incident 2026-09-14 — https://status.brevo.com/incidents/01M2QBC4EZ24ZACW6SWQYVW8N3/write-up
- Brevo SSO account access write-up, 2026-09-10 — https://status.brevo.com/incidents/01M266V1CZKJQNGZRNEGFD5CQE/write-up
- BleepingComputer: Brevo supply-chain attack injected ClickFix scripts on customer sites, 2026-09-17 — https://www.bleepingcomputer.com/news/security/brevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites/
- SecurityWeek: Brevo supply-chain attack injects malware into 100,000 websites, 2026-09-18 — https://www.securityweek.com/brevo-supply-chain-attack-injects-malware-into-100000-websites/
- Security Affairs: Brevo supply-chain attack infected over 100,000 websites, 2026-09-18 — https://securityaffairs.com/199355/hacking/brevo-supply-chain-attack-infected-over-100000-websites.html
- techhelp.ca: Brevo ClickFix supply-chain attack — https://techhelp.ca/brevo-clickfix-supply-chain-attack/
- byteiota: Brevo supply-chain attack API key — https://byteiota.com/brevo-supply-chain-attack-api-key/
- CISA KEV catalog (no Brevo ClickFix/CDN entry as of pack date) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Third-Party Risk Bridge: Marketing CDN Embeds as Supply-Chain Trust
Brevo/Sendinblue is marketing/email SaaS whose forms, Conversations chat, and SDK/tracker scripts are embedded on merchant and brand storefronts. Trust is baked into a script src to cdn.brevo.com (and sibforms). When a stolen Cloudflare API key let an attacker deploy an edge Worker, those third-party assets were rewritten in transit—origins stayed clean—and ClickFix (plus WordPress admin plugin attempts) hit every site loading those widgets during ~16:07–20:30 UTC on 2026-09-14. Sansec’s 100,000+ blast-radius estimate means each embedding merchant is both a supply-chain victim and an attack path to end users and logged-in WP admins. Ask which production sites load Brevo embeds, whether WP admins were active that day, and whether residual plugins/mu-plugins remain—then demand SRI/CSP and secrets-in-code controls in vendor due diligence, not a CVE ticket.
Book a demo to see how Rescana tracks marketing/email SaaS and CDN-embed vendors for supply-chain integrity and third-party script risk after incidents like this.
Forward this advisory to your TPRM owner if Brevo forms, Conversations, or SDK scripts load on your production sites—they own the embed inventory, 2026-09-14 WP-admin/plugin hunt, and residual ClickFix device checks above.
