Hackers Turn Brevo Widgets Into Malware Delivery Channel Across 100,000+ Websites

A suspected supply-chain compromise involving Brevo has exposed visitors and WordPress administrators across more than 100,000 websites to malware.

Attackers allegedly abused Brevo-hosted JavaScript assets, signup forms, unsubscribe pages and chat widgets to distribute a WordPress backdoor and ClickFix social-engineering payloads.

Brevo, formerly Sendinblue, disclosed a separate security incident on September 10 involving an SAML single sign-on flaw.

The company said an attacker accessed 138 accounts, used six to send phishing emails, and exported contact data from 43 accounts.

Brevo said it closed the affected access route and invalidated active sessions the same day.

The security firm said the campaign affected Brevo’s own web properties and customer websites embedding Brevo tracking, conversation-widget, or form services.

PublicWWW currently identifies 114,371 pages referencing Brevo, Sibforms, or Sibautomation resources, illustrating the potential scale of exposure.

Sansec identified an injected script tag loading f.js from attacker-controlled subdomains under sendibt1.com, a Brevo-operated domain.

The observed payload was loaded through domains including cdn2.sendibt1.com, cdn4.sendibt1.com, cdn9.sendibt1.com, cdn10.sendibt1.com, and cdn11.sendibt1.com.

The malicious loader was appended to legitimate Brevo JavaScript resources such as cdn.brevo.com/js/sdk-loader.js and the Brevo Conversations widget.

As a result, organizations that had embedded those scripts could unknowingly serve the second-stage malware to their visitors.

Sansec also observed the injected code on Brevo-owned pages, including www.brevo.com, hosted Sibforms pages, booking pages, and the iframe supporting Brevo’s chat functionality.

This is the defining danger of a third-party JavaScript supply-chain compromise: a single breach at a widely trusted SaaS provider can turn legitimate website integrations into a distribution mechanism for thousands of downstream sites.

The payload reportedly used conditional logic to distinguish WordPress administrators from ordinary visitors.

If a user browsed an affected site while authenticated to WordPress administration, the script attempted to silently install a plugin from cdn10.sendibt1.com/p/wm.zip.

Sansec was unable to recover the ZIP archive, but assessed that it was likely intended as a backdoor.

The installation technique is particularly concerning because it could use an already authenticated administrator’s browser session rather than exploit a WordPress vulnerability directly.

Sansec reported that a far broader, compromise occurred on September 14, when malicious JavaScript was served through Brevo infrastructure between 16:05:18 UTC and 20:12:53 UTC.

That means a compromised Brevo script could potentially create persistent access on a site merely when an administrator visits its public-facing pages.

For other visitors, the malware displayed a full-screen ClickFix overlay masquerading as a human-verification prompt.

ClickFix campaigns commonly instruct targets to copy a command to their clipboard and manually paste it into Windows Run, PowerShell, Terminal, or another command interface.

This bypasses traditional browser exploit controls by persuading victims to execute the malicious code themselves.

Sansec said the malware included anti-analysis checks and did not activate for crawlers, developers, or automated scanners, reducing the likelihood of rapid detection.

The researchers said available evidence points to a possible compromise of Brevo’s Cloudflare environment, though this has not been confirmed by Brevo.

An SSL certificate for cdn.sendibt1.com was created on August 25, indicating that the intruders may have had the ability to modify DNS records for a Brevo-controlled domain.

Sansec also noted that the affected Brevo domains use Cloudflare DNS and that Cloudflare Workers or Snippets can dynamically alter responses.

If attackers obtained access to a shared Cloudflare account, they could potentially create malicious DNS records and inject code into otherwise legitimate JavaScript responses without modifying the origin-hosted files.

The malicious subdomains stopped resolving on September 15, and Sansec said the affected resources are now clean at origin. Still, cached content and already-compromised WordPress environments may continue to pose risk.

Brevo customers that used the tracker, chat widget, or hosted forms should review web and WordPress logs covering September 14.

Key indicators include requests to /wp-admin/update.php?action=upload-plugin, followed by requests to /wp-admin/plugins.php?action=activate.

Administrators should inspect plugins installed or activated on September 14 and compare the plugin directory on disk with entries shown in the WordPress administration panel, since a malicious plugin may hide itself from the interface.

Organizations should also search historical DNS, proxy, CSP, and endpoint telemetry for connections to the cdn*.sendibt1.com subdomains.

Any visitor who encountered a “verify you are human” page and executed its pasted command should be treated as potentially compromised.

Endpoint scans, process-tree review, credential resets where warranted, and incident-response triage should be prioritized.

The incident underscores how embedded SaaS scripts remain a high-impact trust boundary and why continuous third-party script monitoring is now essential.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC