Brevo Supply Chain Attack Injected ClickFix Malware Into 100,000 Sites

Brevo suffered a supply-chain attack that injected malicious code into more than 100,000 websites, according to cybersecurity firm Sansec. The incident began on 10 September, when an attacker exploited a vulnerability in Brevo’s handling of SAML single sign-on to access 138 accounts, including one belonging to cryptocurrency storage provider Trezor. Brevo said phishing emails were sent from six accounts and contact data was exported from 43.

Although Brevo closed the unauthorised access, the attacker returned on 14 September using a compromised, long-lived Cloudflare API key to deploy a worker. The worker injected scripts into brevo.com, sibforms.com and three JavaScript files embedded by customers on their websites. Brevo said the malicious worker was active for about five and a half hours, while Sansec estimated that the malware was served for roughly four hours.

Brevo said its investigation found no malicious content injected into customer-facing pages before 14 September, although the API key had apparently been misused in late August 2026.

The injected script showed selected visitors a fake “Cloudflare, verify you are human” page that told them to paste and run a command on their computers, using the ClickFix social-engineering technique. On WordPress sites using a Brevo widget, it also attempted to install and run a plugin when the visitor was logged in as an administrator. Brevo removed the worker and revoked the compromised key and credentials.

Sansec recommends that affected site administrators check for unauthorised WordPress plugins and that visitors who saw the fake verification page check their devices for malware.