Brevo Supply-Chain Attack Infected Over 100,000 Websites
Attackers with a stolen Cloudflare API key turned Brevo's CDN into a malware channel, injecting code into 100,000+ customer websites.
90
Vendor
Sendinblue
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 16, 2026
- Last mentionedSep 18, 2026
Timeline
2 articles · newest firstBrevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malware
Attackers with Brevo DNS access injected malicious scripts serving ClickFix malware and WordPress backdoors to over 100,000 customer sites on 14 September 2026.
85
Appears with
- Sansecvendor · 2
- Cloudflarevendor · 2
- Brevovictim · 2
- Brevovendor · 2
- WordPressproduct · 2
- eBayvictim · 1
- Amnesty Internationalorganization · 1
- Michelinorganization · 1
- eBayorganization · 1
- Michelinvictim · 1
- Trezorvendor · 1
- Cloudflare Workersproduct · 1
- Louis Vuittonvictim · 1
- TestFlightproduct · 1
- Trezorvictim · 1
- Web Media Optimizermalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.