Hackers Turn Brevo Widgets Into Malware Delivery Channel Across 100,000+ Websites
Attackers compromised Brevo-hosted JavaScript to deliver a WordPress backdoor and ClickFix payloads across 100,000+ websites, exposing visitors and admins.
Sansec found injected script tags loading f.js from attacker-controlled subdomains of sendibt1.com appended to legitimate Brevo resources, with PublicWWW listing 114,371 pages referencing Brevo assets. During a September 14 window (16:05:18–20:12:53 UTC), the conditional payload installed a plugin from cdn10.sendibt1.com/p/wm.zip into WordPress admin sessions and showed other visitors a fake human-verification ClickFix overlay instructing them to run pasted commands. Evidence, including an August 25 SSL certificate for cdn.sendibt1.com and Cloudflare DNS usage, suggests a possible compromise of Brevo's Cloudflare environment, unconfirmed by Brevo. Brevo separately disclosed a September 10 SAML SSO incident in which an attacker accessed 138 accounts, sent phishing from six, and exported contacts from 43.
- Injected scripts on 100,000+ sites served a WordPress admin backdoor and ClickFix social-engineering overlays to visitors
- Malicious JavaScript was served through Brevo infrastructure on September 14 between 16:05 and 20:12 UTC
- Possible compromise of Brevo's Cloudflare environment; cdn.sendibt1.com SSL certificate created August 25
- Separate Brevo SAML SSO incident exposed 138 accounts, with contact data exported from 43
- Defenders urged to audit September 14 WordPress plugin installs and logs for cdn*.sendibt1.com
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1189 Drive-by CompromiseT1078 Valid AccountsT1204.002 User Execution: Malicious File
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cdn10.sendibt1.com | cdn2.sendibt1.com , cdn4.sendibt1.com , cdn9.sendibt1.com , cdn10.sendibt1.com , and cdn11.sendibt1.com . The malicious loader was appende |
| domain | cdn11.sendibt1.com | sendibt1.com , cdn9.sendibt1.com , cdn10.sendibt1.com , and cdn11.sendibt1.com . The malicious loader was appended to legitimate Brevo Jav |
| domain | cdn2.sendibt1.com | . The observed payload was loaded through domains including cdn2.sendibt1.com , cdn4.sendibt1.com , cdn9.sendibt1.com , cdn10.sendibt1.co |
| domain | cdn4.sendibt1.com | ad was loaded through domains including cdn2.sendibt1.com , cdn4.sendibt1.com , cdn9.sendibt1.com , cdn10.sendibt1.com , and cdn11.sendib |
| domain | cdn9.sendibt1.com | h domains including cdn2.sendibt1.com , cdn4.sendibt1.com , cdn9.sendibt1.com , cdn10.sendibt1.com , and cdn11.sendibt1.com . The malicio |
| domain | sendibt1.com | tag loading f.js from attacker-controlled subdomains under sendibt1.com , a Brevo-operated domain. The observed payload was loaded |
From the original article
3 min read at gbhackers.com
A suspected supply-chain compromise involving Brevo has exposed visitors and WordPress administrators across more than 100,000 websites to malware. Attackers allegedly abused Brevo-hosted JavaScript assets, signup forms, unsubscribe pages and chat widgets to distribute a WordPress backdoor and ClickFix social-engineering payloads.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.