Attackers Hijacked Brevo Widgets and Hit 100,000 Sites Before Anyone Noticed the Supply Chain

Attackers used a stolen Brevo Cloudflare API key to inject ClickFix scripts into customer sites on 14 September 2026. Brevo's status post-mortem says a Worker rewrote responses at the CDN edge from 15:01 to 20:30 UTC, about 5 hours and 29 minutes. CyberInsider, citing Sansec, put the downstream reach at more than 100,000 sites. Brevo's write-up does not cite that number.

BleepingComputer carried the same incident. There is no CVE and no CISA Known Exploited Vulnerabilities listing.

The embedded JavaScript loader append started at 16:07 UTC and was removed at 20:30. Affected surfaces included pages on brevo.com and sibforms.com, plus three customer-embedded JavaScript surfaces: the SDK loader, the Conversations widget, and forms. The ClickFix lure was a fake Cloudflare "verify you are human" page telling Windows users to press Win+R, Ctrl+V, and Enter, then run a clipboard command that downloaded malware, the same bait family as the HBO Max Reddit ClickFix campaign.

On WordPress sites embedding Brevo widgets, if the visitor was a logged-in administrator, the script also tried to silently install and activate a plugin. Sansec said the plugin was fetched from cdn10.sendibt1.com/p/wm.zip and that it did not recover the binary, so Sansec could not confirm what the plugin did.

Not affected: app.brevo.com, the Brevo API, email sending, and customer account data held in Brevo. Origin source files were unmodified. The root cause was a long-lived Cloudflare API key with full account permissions stored in application source code. Brevo says the key was first misused in late August 2026, and it found no customer-facing injection before 14 September.

A separate Brevo SAML SSO incident on 10 September, affecting 138 accounts, is prior-week context. It is not the same attack.

Some offers on this page may be paid placements or contain affiliate links.