Brevo supply-chain attack injected ClickFix scripts on customer sites
Attackers used a stolen Cloudflare API key to inject ClickFix malware-delivery scripts into Brevo sites and customer-embedded scripts for five hours.
Brevo confirmed attackers stole a long-lived Cloudflare API key with full account permissions that had been hardcoded in source code, and used it to create a malicious Cloudflare Worker that rewrote content at the CDN edge for roughly 5.5 hours on September 14 (16:07-20:30 UTC), affecting brevo.com, sendinblue.com, sibforms.com, and customer-embedded Brevo scripts; Sansec estimated up to 100,000 websites may have been exposed. Visitors saw fake Cloudflare verification pages with ClickFix instructions to run a Windows command, and the injected code uploaded a persistent WordPress backdoor plugin named 'Web Media Optimizer' to sites where logged-in admins browsed. The backdoor hides from the plugin list, persists in the must-use plugins directory, contacts attacker servers, and contains a hardcoded key to forge WordPress administrator sessions. Brevo said app.brevo.com, its API, email delivery, and customer data were unaffected; a separate September 10 SSO incident led to Trezor phishing hitting 347,000 addresses with at least 2,500 accounts compromised.
- Full-permission Cloudflare API key was hardcoded in Brevo source code and stolen
- Malicious Worker rewrote edge responses and stripped Content-Security-Policy headers to evade integrity checks
- Fake Cloudflare verification pages served ClickFix commands; WordPress admins received 'Web Media Optimizer' backdoor
- Backdoor persists via must-use plugins and holds a key to forge admin login sessions
- Separate September 10 SSO incident fueled Trezor phishing reaching 347,000 users, 2,500+ compromised
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1078 Valid AccountsT1204.002 User Execution: Malicious FileT1562.001 Impair Defenses: Disable or Modify Tools
- Malware
- Web Media Optimizer
- Victims
- Trezor
- Organizations
- Trezor
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | boiseno.club | gin and scripts include https://yelahaye[.]surf and https://boiseno[.]club. Once installed, it hides itself from the WordPress plugi |
| domain | corralos.beer | s' pages. The current Base64-encoded URL decodes to https://corralos[.]beer/a412dkoq.js, which the site injects to fetch a ClickFix l |
| domain | sendibt1.com | d attempted to upload a malicious plugin from https://cdn10.sendibt1[.]com/p/wm.zip. While SanSec was not able to retrieve the archi |
| domain | yelahaye.surf | the malicious WordPress plugin and scripts include https://yelahaye[.]surf and https://boiseno[.]club. Once installed, it hides itse |
From the original article
3 min read at bleepingcomputer.com
Brevo confirmed that attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its websites and JavaScript files embedded on customer sites to distribute malware. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.