Hackers Turn Brevo Widgets Into Malware Delivery Channel Across 100,000+ Websites
Attackers compromised Brevo-hosted JavaScript to deliver a WordPress backdoor and ClickFix payloads across 100,000+ websites, exposing visitors and admins.
82
Product
Brevo Conversations
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 17, 2026
- Last mentionedSep 18, 2026
Timeline
2 articles · newest firstBrevo supply-chain attack injected ClickFix scripts on customer sites
Attackers used a stolen Cloudflare API key to inject ClickFix malware-delivery scripts into Brevo sites and customer-embedded scripts for five hours.
80
Appears with
- Cloudflarevendor · 2
- Brevovendor · 2
- Sansecvendor · 2
- Automattic/WordPressvendor · 1
- Web Media Optimizerproduct · 1
- BleepingComputervendor · 1
- WordPressproduct · 1
- Sansecorganization · 1
- Brevoorganization · 1
- Trezorvictim · 1
- Sibformsproduct · 1
- Web Media Optimizermalware · 1
- Trezororganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.