Brevo Supply Chain Attack: ClickFix Malware and WordPress Backdoor Risk Across 100,000+ Sites
Quick Answer: A stolen Cloudflare API key let attackers inject ClickFix scripts into Brevo widgets on September 14, exposing an estimated 100,000+ sites. Audit WordPress plugins and logs from that day; treat any machine that ran a pasted command as compromised.
Last verified: September 20, 2026. This story is still developing, so details may change as Brevo and researchers publish more.
Picture a Monday afternoon. A small-business owner logs into WordPress to check why a newsletter form looks off, then opens the public site in another tab to test it. Nothing looks unusual. No warning, no error, no download prompt. Behind the scenes, a script loaded from a trusted marketing vendor may have just asked the browser to install a plugin on the owner's own site. (This is an illustrative scenario built from the public reporting, not a specific victim.)
That is the shape of the Brevo supply chain attack on September 14, 2026. The attackers never had to break into each website. They tampered with scripts that customer sites already trusted. Here is what is confirmed, what is still assessment, and how to check your own exposure.
Table of Contents
- What Happened: The Confirmed Timeline
- How the Attack Worked at the CDN Edge
- Two Attack Paths: ClickFix and the WordPress Plugin
- How Big Was the Exposure?
- Indicators of Compromise (IOCs)
- Detection: How to Check WordPress and Endpoints
- WordPress Security and Prevention Checklist
- Third-Party Risk Management Lessons for SOC Teams
- Expert Tips
- What We Still Don't Know
- FAQ
- Sources
What Happened: The Confirmed Timeline
Brevo (formerly Sendinblue) is a French marketing platform. Sansec, the firm that first reported the incident, lists eBay, Louis Vuitton, Michelin, and Amnesty International among its customers.
This was not Brevo's first bad week. Four days earlier, on September 10, Brevo disclosed a separate incident. According to SecurityWeek's summary of the company's notice, an attacker abused how Brevo handles SAML single sign-on to reach 138 accounts. Six accounts were used to send phishing emails, and contacts were exported from 43 accounts. Trezor later said about 347,000 of its users received phishing emails, and at least 2,500 were compromised, per BleepingComputer's reporting.
The September 14 incident is different. Brevo's own post-mortem gives this timeline (all times UTC):
| Time | Event (per Brevo's post-mortem) |
| Late August | Brevo's investigation indicates the compromised key was first misused. No malicious injection into customer-facing pages was found before September 14. |
| 14:23 | Attacker creates the first hostname used to serve the script, on a Brevo-owned domain. |
| 14:28 | Malicious Cloudflare Worker deployed and tested on low-traffic Brevo domains. |
| 15:01 | Worker routed across all of brevo.com. Impact begins. |
| 16:07 | Worker updated to append a loader to three JavaScript files that customers embed, and routed to sibforms.com. |
| 19:33 | Brevo opens a security incident. |
| 20:30 | Worker and routes removed, compromised key revoked. Injection stops. |
| September 15 | Customer notification begins. Sansec confirms the attacker-controlled hostnames stopped resolving. |
Sansec's own monitoring recorded the malicious script being served between 16:05:18 and 20:12:53 UTC. The gap with Brevo's window (which starts at 15:01) is likely explained by the two parties measuring different things: Brevo counts when the Worker went live, while Sansec counts when it observed the malicious loader. That is my reading, not something either party has stated.
How the Attack Worked at the CDN Edge
Here is the confirmed root cause per Brevo: a long-lived Cloudflare API key with full account permissions was stored in application source code, and the attacker obtained it. With that key, they could create Workers, routes, and DNS records on Brevo's zones without triggering an alert.
A Cloudflare Worker sits between a visitor and the origin server and can rewrite responses in transit. That is what made this hard to catch. Brevo says the Worker also stripped security headers such as Content-Security-Policy, and its origin servers and files stayed unmodified, so standard integrity checks saw nothing wrong.
This is the uncomfortable lesson for defenders. If your monitoring compares files at the origin, an edge-level change can walk right past it. The customer-facing scripts looked clean where teams were checking, and were modified only where visitors received them.
Sansec also reported that the malicious infrastructure used sendibt1.com, a domain owned and operated by Brevo, which Sansec says indicates the attacker had write access to Brevo's DNS records. Cybernews adds that a certificate for a subdomain on that domain was created weeks before the incident, which is consistent with the late-August misuse Brevo describes.
Two Attack Paths: ClickFix Malware and the WordPress Plugin
Path 1: The ClickFix overlay for ordinary visitors
ClickFix malware delivery works by persuasion rather than a browser flaw. Per Brevo, selected visitors saw a full-screen, Cloudflare-branded "verify you are human" page, sometimes right after a genuine Cloudflare checkbox. It told them to press Win+R, then Ctrl+V, then Enter. The script had already placed a command on the clipboard, and following the steps downloaded malware onto the visitor's Windows computer.
Brevo says the page was shown selectively, so most visitors and repeat visits saw nothing. Sansec reported that people who clicked unsubscribe links in Brevo-sent campaign emails could also see the overlay. Reporting on Sansec's analysis also notes the script contained checks meant to avoid crawlers, developers, and automated scanners, which helps explain why many site owners never noticed.
The sources I reviewed do not name the malware family that the pasted command installed. Treat any affected endpoint as fully compromised until analysis says otherwise.
Path 2: The WordPress plugin for logged-in administrators
On WordPress sites embedding an affected Brevo widget, the script checked whether the visitor was logged in as an administrator. If so, it attempted to silently install and activate a plugin from an attacker-controlled address, using the administrator's own session.
Sansec could not retrieve the archive. BleepingComputer later found a copy on VirusTotal and reported that it poses as a plugin called "Web Media Optimizer" but behaves as a persistent backdoor and JavaScript loader. According to BleepingComputer's analysis, it hides itself from the plugin list, copies itself into the must-use plugins directory, periodically contacts attacker infrastructure for more JavaScript, and contains a hardcoded key that can generate an administrator session without the real password.
My analysis (not a confirmed finding): because this step rides an already-authenticated browser session, multi-factor authentication at login would not have stopped it. That is why reducing what an admin session can do matters as much as protecting the login.
How Big Was the Exposure?
The headline number is "100,000+ sites," and it deserves careful reading. It is Sansec's estimate, based on a source-code search for sites embedding the affected Brevo components. It measures exposure, not confirmed infections. Cybernews cites public scans finding roughly 117,000 web pages referencing Brevo infrastructure.
Actual harm is narrower for three reasons. The overlay was shown selectively and targeted Windows users. The plugin path required a logged-in WordPress admin to visit an affected site during the window. And the scripts were served on non-WordPress sites too, so this was never only a WordPress story. Sansec's content-security-policy monitoring recorded 2,549 violation reports across 12 sites, a small sample that at least confirms real-world delivery.
Indicators of Compromise (IOCs)
Everything below is defanged. Brevo and Sansec report the malicious hostnames no longer resolve, so use these for retrospective hunting in DNS, proxy, and web logs from September 14 onward.
| Type | Indicator | Source |
| Domain family | sendibt1[.]com and its cdn subdomains | Sansec |
| Script URLs | cdn9[.]sendibt1[.]com/f.js, cdn2[.]sendibt1[.]com/f.js | Sansec |
| Plugin archive | cdn10[.]sendibt1[.]com/p/wm.zip | Sansec, BleepingComputer |
| Plugin name | "Web Media Optimizer" | BleepingComputer |
| Plugin server | glegchner[.]com/ads.php | BleepingComputer |
| Other hosts seen | corralos[.]beer, yelahaye[.]surf, boiseno[.]club | BleepingComputer |
| Web log artifacts | POST /wp-admin/update.php?action=upload-plugin and GET /wp-admin/plugins.php?action=activate on September 14 | Sansec (via reporting) |
Detection: How to Check WordPress and Endpoints
Preserve evidence first. Snapshot the server and copy logs before you clean anything, because log rotation can erase your only proof.
Step 1: Search web server logs for plugin activity on September 14
zgrep -hE "14/Sep/2026.*(update\.php\?action=upload-plugin|plugins\.php\?action=activate)" /var/log/nginx/access.log*What it does: searches current and compressed rotated Nginx logs for plugin upload and activation requests dated September 14. Swap the path for /var/log/apache2/access.log* on Apache. When to use it: on any site that loaded Brevo scripts. Expected output: nothing on a clean site. Any hit needs a check against who actually performed the action. Remember log timestamps may use your server's timezone, not UTC.
Step 2: List plugins, including must-use plugins
wp plugin list --fields=name,status,version
wp plugin list --status=must-use --fields=name,status,version
ls -la wp-content/mu-plugins/What it does: lists installed and must-use plugins through WP-CLI, then shows the mu-plugins folder directly. When to use it: because BleepingComputer reports the backdoor hides from the normal plugin list, compare this filesystem view with what the admin screen shows. Expected output: only plugins you recognize. An unfamiliar name, or a file in mu-plugins that you did not put there, is a red flag.
Step 3: Find recently changed PHP files
find wp-content -type f -name "*.php" -newermt "2026-09-14" ! -newermt "2026-09-16"What it does: lists PHP files modified between September 14 and 16. Expected output: legitimate updates will appear too, so match each hit against your own change history.
Step 4: Check a Windows endpoint for Run dialog history
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"What it does: reads the recent Run dialog history for the current user. When to use it: when a user reports seeing a "verify you are human" page. Expected output: a short list of typed or pasted entries. A long, obfuscated PowerShell string is a strong lead. This is my suggested hunting artifact, not something the incident reports specify.
Step 5: Hunt process behavior in your EDR
Process creation logging (Security Event ID 4688, with command-line auditing enabled) and PowerShell script block logging (Event ID 4104) give you the raw material. In Microsoft Defender, a starting query looks like this:
DeviceProcessEvents
| where Timestamp > ago(14d)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "cmd.exe")
| where ProcessCommandLine has_any ("-enc", "-EncodedCommand", "iex", "Invoke-Expression", "http")What it does: finds shells launched from Explorer (which is how the Run dialog starts programs) with encoded or download-style command lines. Expected output: some benign noise from admins and scripts, so tune it for your environment. Strong endpoint detection and response tooling gives you the telemetry, but the user ran the command themselves, so behavior-based review matters more than file scanning.
WordPress Security and Prevention Checklist
- Take dashboard installs off the table. Setting
define('DISALLOW_FILE_MODS', true);in wp-config.php disables plugin and theme installation and updates from the dashboard. You will need to manage updates through deployment tooling or WP-CLI, so test it first. This one setting would have blocked the silent plugin install path. - Separate admin browsing. Use a dedicated browser profile for wp-admin and log out when finished. Do not browse your own public site in the same logged-in session.
- Tighten your Content Security Policy. Allowlist exact script hosts and enable violation reporting. Sansec's use of CSP reports to spot this activity shows the value. Analysis: a strict, reported policy gives you a chance to see unexpected hosts early.
- Inventory third-party scripts. You cannot assess what you have not listed. Track every external script, who owns it, and what pages load it.
- Rotate after exposure. If an admin visited an affected site while logged in on September 14, remove suspicious plugins and change administrator passwords, as Brevo advises.
- Consider restricting the Run dialog through Group Policy on managed Windows fleets where workflows allow, and train staff that no legitimate site asks you to paste commands into a terminal or Run box.
Third-Party Risk Management Lessons for SOC Teams
The root cause was a secret in source code and a key with far more power than it needed. Brevo says it is moving Cloudflare credentials into HashiCorp Vault with automatic rotation, using narrowly scoped short-lived tokens, alerting on every Cloudflare audit event that changes Workers, routes, DNS, or account access, and streaming Cloudflare logs to its security monitoring platform.
For customers, the takeaway for third-party risk management is that a vendor's questionnaire answers say little about its secrets hygiene. Ask concrete questions: how are edge and CDN credentials stored, how long do they live, and who is alerted when a Worker or route changes? Frameworks such as NIST SP 800-161 on cybersecurity supply chain risk management give a structure for these conversations. If a vendor incident exports personal data, as the September 10 Brevo incident did for contacts in 43 accounts, breach-notification duties under laws like GDPR may come into play. Involve your legal team rather than guessing.
Expert Tips
- Monitor what visitors receive, not just what you deploy. Synthetic checks that fetch third-party scripts and alert on hash changes help. Caveat: reporting says this malware avoided scanners, so pair it with CSP reports and real-user monitoring.
- Treat "vendor says it is clean" as a claim to verify. Brevo states its widgets, SDK, and forms were never modified at source and are safe to use. That is the vendor's position. Verify against your own logs before closing the ticket.
- Check phishing exposure separately. If you used Brevo for email, the September 10 incident is its own workstream from the September 14 script injection.
- Do not trust the plugin list alone. Compare the filesystem to the dashboard every time you investigate a WordPress compromise.
- Brief non-technical staff. ClickFix works on busy, well-meaning people, so a two-line warning in your next all-hands is cheap protection.
What We Still Don't Know
Confirmed by Brevo: a stolen Cloudflare API key, a malicious Worker, roughly five and a half hours of impact, and no evidence of injection before September 14.
Not yet public: how the attacker obtained the key, whether this incident connects to the September 10 single sign-on breach (Brevo did not answer BleepingComputer's question on this), who is responsible, and which malware family the ClickFix command delivered. No attribution has been made, so avoid assigning blame to any group.
Related Cybersecurity Topics You Should Explore
- Linux sort Command Guide: Rank Attacker IPs in Seconds
- Settra Ransomware: The Log Attackers Forgot to Clear
- UAE's AI Lab Tests Every Model for Hidden Risks
- Check Point CVE-2026-91843: Root Access, No Login Needed (Patch Now)
- Why 40% of Indian SMEs Got Breached Despite Rising Cybersecurity Budgets
- cPanel's EmailTrack Bug: How Low-Privilege Users Reach Root Access
- 3,562 Redis Servers Hacked for Crypto Mining: Is Your Server Next?
- CVE-2026-26084 Explained: Patch FortiSandbox Now
FAQ
Was my website hacked if it uses Brevo?
Not necessarily. Your site may have served the malicious script to some visitors, but the overlay was selective and the plugin path needed a logged-in admin visit on September 14. Check your logs and plugins to be sure.
Are Brevo's widgets safe to use now?
Per Brevo, the affected pages and scripts were verified clean after the Worker was removed, and the widgets were never modified at their source. Sansec also reported the origin was clean and the malicious hosts stopped resolving on September 15.
What is ClickFix?
ClickFix is a social engineering technique that shows a fake error or verification page and coaches you into pasting and running a command yourself. It works because the user starts the action.
How do I find a hidden WordPress backdoor plugin?
Compare the plugins folder and the must-use plugins folder on disk against the admin plugin list, review September 14 logs for upload and activation requests, and check for recently modified PHP files.
Was customer data stolen on September 14?
Brevo says its application, API, email delivery, and customer account data were not affected in the September 14 incident. The separate September 10 incident did involve exported contacts from 43 accounts.
Can antivirus stop a ClickFix attack?
Not reliably. The user runs the command, so no single tool guarantees protection. Layered defenses, including behavior-based endpoint detection, user training, and restricting the Run dialog where practical, reduce risk.
Who was behind the Brevo attack?
No public attribution exists in the sources reviewed.
Conclusion
The Brevo incident is a clean example of why a supply chain attack scales so well: one stolen key, one edge-level change, and a trusted script tag did the rest. If your sites embed Brevo components, spend thirty minutes on the log and plugin checks above, and make sure your admins know to report any "verify you are human" page that asks them to paste a command.
Found something suspicious, or have a detection tip I missed? Share it in the comments, subscribe for future incident breakdowns, and pass this along to a WordPress admin who needs it.
Analysis based on SOC monitoring and public threat intelligence review.