Brevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malware
Attackers with Brevo DNS access injected malicious scripts serving ClickFix malware and WordPress backdoors to over 100,000 customer sites on 14 September 2026.
Brevo (formerly Sendinblue), an email marketing platform whose clients include eBay, Louis Vuitton, Michelin and Amnesty International, served injected JavaScript from sendibt1.com domains between 16:05 and 20:12 UTC on 14 September 2026, reaching over 100,000 customer sites and mailing lists. The f.js malware secretly installed a WordPress backdoor plugin from cdn10.sendibt1.com/p/wm.zip using logged-in admins' sessions and showed ClickFix overlays urging visitors to copy-paste and run commands. An SSL certificate for cdn.sendibt1.com created August 25 and attacker-created cdn* DNS records indicate write access to Brevo's Cloudflare DNS, likely via a single Cloudflare account compromise. Sansec recorded 2,549 CSP violation reports across 12 monitored sites; all malicious hosts stopped resolving on 15 September and Brevo's status page lists no incident.
- Brevo served injected f.js malware to 100k+ customer sites and its own pages for roughly four hours on 14 September.
- Malware installed a WordPress backdoor plugin via logged-in admins' sessions; non-admins saw ClickFix copy-paste overlays.
- Attacker-created cdn*.sendibt1.com DNS records suggest compromise of Brevo's Cloudflare account.
- Malicious hosts stopped resolving 15 September; Brevo's status page still shows no incident.
- Admins should check access logs for wp-admin plugin uploads and scan for rogue plugins installed 14 September.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1204.004 Malicious Copy and PasteT1584.002 DNS Server
- Products
- WordPress
- Malware
- f.js
- Victims
- Brevo
- Organizations
- eBayLouis VuittonMichelinAmnesty International
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | brevo.com | n a Brevo-sent campaign email AttackerBrevocode injected in brevo.com & sendibt1.comBrevo customers100k+ sites and mailing listsE |
| domain | cdn10.sendibt1.com | om cdn9.sendibt1.com 188.114.97.3 first observed 2026-09-14 cdn10.sendibt1.com cdn11.sendibt1.com # C2 paths, relative to the malware host |
| domain | cdn11.sendibt1.com | m 188.114.97.3 first observed 2026-09-14 cdn10.sendibt1.com cdn11.sendibt1.com # C2 paths, relative to the malware host /f.js the loader / |
| domain | cdn2.sendibt1.com | hild (s); })(); These loader domains vary: cdn.sendibt1.com cdn2.sendibt1.com cdn3.sendibt1.com cdn4.sendibt1.com cdn9.sendibt1.com cdn10 |
| domain | cdn3.sendibt1.com | ese loader domains vary: cdn.sendibt1.com cdn2.sendibt1.com cdn3.sendibt1.com cdn4.sendibt1.com cdn9.sendibt1.com cdn10.sendibt1.com cdn1 |
| domain | sendibt1.com | s suggests a single Cloudflare account holding all of them, sendibt1.com included. That is the zone where the attacker created the c |
| domain | sendinblue.com | udflare DNS: brevo.com , sibforms.com , sibautomation.com , sendinblue.com and sendibt1.com . This suggests a single Cloudflare accoun |
| domain | sibautomation.com | domains all use Cloudflare DNS: brevo.com , sibforms.com , sibautomation.com , sendinblue.com and sendibt1.com . This suggests a single |
| domain | sibforms.com | revo.com iframe page that backs the chat widget, and on the sibforms.com pages that serve hosted signup and unsubscribe forms: < scr |
| ipv4 | 104.21.77.104 | sts (all NXDOMAIN since 15 September 2026) cdn.sendibt1.com 104.21.77.104 created 2026-08-25 17:08 UTC cdn2.sendibt1.com cdn3.sendibt |
| ipv4 | 172.246.243.65 | endibt1.com itself is not proxied, answering on Brevo's own 172.246.243.65 in AS200484 with server: envoy , while only the attacker's |
| ipv4 | 188.114.97.3 | 1.com cdn3.sendibt1.com cdn4.sendibt1.com cdn9.sendibt1.com 188.114.97.3 first observed 2026-09-14 cdn10.sendibt1.com cdn11.sendibt1 |
| sha256 | 26166cd87ff07e7a50317a24126d14b262e842c5715585636dee3ab3f227ddca | tps://conversations-widget.brevo.com/brevo-conversations.js 26166cd87ff07e7a50317a24126d14b262e842c5715585636dee3ab3f227ddca clean, 72816 B 9b62c12bc5c7feb9802f58e6cf75a368690df3c754e3 |
| sha256 | 4af488d79aef7daa12b1c18f0cce28b7edadccb8b6b0fb8d50d1d53a9a7c2df7 | sponse, identical across every host and every observed scan 4af488d79aef7daa12b1c18f0cce28b7edadccb8b6b0fb8d50d1d53a9a7c2df7 {"s":0,"r":"https:\/\/www.google.com"} # Do not block sendi |
| sha256 | 58a5c601c9df7ca2120435588fc39f97712d9b878795f6ee500590099a432308 | 71db2c749fcc24a5bec3875f3654042169fb2418aed09 clean, 3442 B 58a5c601c9df7ca2120435588fc39f97712d9b878795f6ee500590099a432308 injected -> cdn2 f67d572d2d30407b3f470904326411450763108980 |
| sha256 | 9b62c12bc5c7feb9802f58e6cf75a368690df3c754e37cc64483a92acacf87a5 | 7a24126d14b262e842c5715585636dee3ab3f227ddca clean, 72816 B 9b62c12bc5c7feb9802f58e6cf75a368690df3c754e37cc64483a92acacf87a5 injected -> cdn4 # The appended line (final line of each fi |
| sha256 | f67d572d2d30407b3f470904326411450763108980cdad89550fbb221fb06782 | 588fc39f97712d9b878795f6ee500590099a432308 injected -> cdn2 f67d572d2d30407b3f470904326411450763108980cdad89550fbb221fb06782 injected -> cdn11 https://conversations-widget.brevo.com/br |
| sha256 | fe8447fd1ec4dca652b71db2c749fcc24a5bec3875f3654042169fb2418aed09 | e 15 September 2026) https://cdn.brevo.com/js/sdk-loader.js fe8447fd1ec4dca652b71db2c749fcc24a5bec3875f3654042169fb2418aed09 clean, 3442 B 58a5c601c9df7ca2120435588fc39f97712d9b878795f |
From the original article
5 min read at sansec.io
Brevo (aka Sendinblue) lists eBay, Louis Vuitton, Michelin and Amnesty International as its clients. It disclosed (copy) a security incident on 10 September, claiming that 6 customer accounts were ...
By Sansec Forensics Team · sansec.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.