Brevo Supply Chain Attack Injects Malware Into 100,000 Websites
Attackers breached Brevo, hijacked a Cloudflare API key, and injected ClickFix malware scripts served to visitors of 100,000+ websites including Trezor.
Brevo was hacked on September 10, 2026, via a vulnerability in its SAML SSO handling, exposing 138 accounts including crypto storage provider Trezor; attackers phished from six accounts and exported contacts from 43. On September 14 they used a compromised long-lived Cloudflare API key to deploy a worker that injected malicious scripts into brevo.com, sibforms.com, and three JavaScript files embedded in customer websites. The scripts showed fake 'Cloudflare, verify you are human' pages using the ClickFix technique and tried to install a malicious WordPress plugin for logged-in admins. Sansec estimates more than 100,000 websites were affected during roughly four hours; the API key was first misused in late August 2026.
- Initial September 10 access exploited a SAML SSO handling flaw, compromising 138 accounts.
- Compromised Cloudflare API key deployed a worker injecting scripts into customer-embedded JavaScript files.
- Fake 'Cloudflare verify you are human' pages used ClickFix to trick users into running commands.
- On WordPress, the script attempted to install a plugin when a logged-in admin visited.
- Sansec estimates 100,000+ websites served malware for roughly four hours; admins should audit plugins.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1195.002 Compromise Software Supply ChainT1204.001 Malicious Link
- Vendors
- BrevoCloudflareSansec
- Products
- sibforms.comWordPress
- Victims
- Trezor
- Organizations
- BrevoCloudflareTrezorSansec
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | brevo.com | eploy a worker. That worker injected malicious scripts into brevo.com and sibforms.com, and into three JavaScript files that Brev |
| domain | sibforms.com | . That worker injected malicious scripts into brevo.com and sibforms.com, and into three JavaScript files that Brevo’s customers emb |
From the original article
2 min read at securityweek.com
Hackers used a compromised API key to deploy a Cloudflare worker that injected malicious scripts. The post Brevo Supply Chain Attack Injects Malware Into 100,000 Websites appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.