Reported by 4 outlets

Timeline

1. original reporting

   Incident is now documented: - https:// sansec.io/research/brevo -supply-chain-attack … - https:// bleepingcomputer.com/news/security/ brevo-

   sansec.io · 25d ago · September 18th, 2026

   Incident is now documented: - https:// sansec.io/research/brevo -supply-chain-attack … - https:// bleepingcomputer.com/news/security/ brevo-

   via X https://sansec.io/research/brevo-supply-chain-attack

2. update from bleepingcomputer.com

   Brevo supply-chain attack injected ClickFix scripts on customer sites

   bleepingcomputer.com · 26d ago · September 17th, 2026

   Brevo confirmed that attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its websites and JavaScript files embedded on customer sites to distribute malware. The customer relationship management and digital marketing company says the attackers used the API key to create a malicious Cloudflare Worker that modified content at the CDN edge for approximately five and a half hours on September 14. The attack affected pages on brevo.com, sendinblue.com, login/account/my/onboarding.brevo.com, and sibforms.com. The Cloudflare worker also modified the Brevo forms script, Brevo Conversations widget, and the Brevo SDK loader scripts that customers embed on their websites. In a post-mortem published today , Brevo explained that attackers obtained a long-lived Cloudflare API key with full account permissions that had been hardcoded in application source code, which allowed them to create Cloudflare Workers, routes, and DNS records across Brevo's zones without triggering an alert. "Because the Worker rewrote responses at the edge and removed security headers such as Content-Security-Policy, our origin servers and files remained unmodified and standard integrity checks did not detect the change," explained Brevo. The company says the key may have been compromised as early as late August, but there's no evidence of prior malicious activity. Upon detecting the compromise, Brevo removed the Worker and its routes, defining the exposure window as between 16:

3. update from securityweek.com

   Brevo Supply Chain Attack Injects Malware Into 100,000 Websites

   securityweek.com · 25d ago · September 18th, 2026

   Customer engagement platform Brevo fell victim to a supply chain attack that resulted in malicious code being injected into over 100,000 websites. Brevo was initially hacked on September 10, when a threat actor exploited a vulnerability in Brevo’s handling of SAML SSO to access 138 accounts, including one belonging to cryptocurrency storage provider Trezor . The attackers sent phishing emails from six of the accounts and exported the contacts of 43 accounts, Brevo said in an incident notice . “The script showed selected visitors a fake ‘Cloudflare, verify you are human’ page that instructed them to paste and run a command on their computer, a social-engineering technique known as ClickFix,” Brevo explains. On the WordPress websites embedding a Brevo widget, the script attempted to deploy and run a plugin if the visitor was logged in as an administrator. “Our investigation indicates the key was first misused in late August 2026. We have found n

4. update from sansec.io

   Brevo Supply Chain Attack Pushes WordPress Backdoors and ClickFix Malware to 100,000+ Sites Indicators extracted from public reporting. Sour

   sansec.io · 25d ago · September 18th, 2026

   Brevo Supply Chain Attack Pushes WordPress Backdoors and ClickFix Malware to 100,000+ Sites Indicators extracted from public reporting.

5. update from theperimetersite.com

   Your CDN is serving malware to everyone. You didn't touch the code. The server is patched. Your firewall is tight. Still, you're the one exp

   theperimetersite.com · 25d ago · September 18th, 2026

   Your CDN is serving malware to everyone. You didn't touch the code. The server is patched. Your firewall is tight. Still, you're the one exp

   via Mastodon https://theperimetersite.com/report/275

6. update from securityweek.com

   Brevo supply-chain attack affected 100,000+ websites through compromised Cloudflare API key

   securityweek.com · 25d ago · September 18th, 2026

   The interesting part is that the initial compromise was not just a direct customer breach, it became a downstream risk through trusted infrastructure and embedded scripts. This is another reminder that API keys, third-party integrations, and SaaS dependencies are becoming a major security boundary. A lot of organizations focus heavily on protecting their own environment, but the question is, how much trust should we place in vendors that are embedded into our applications? Source: SecurityWeek submitted by /u/sunychoudhary [link] [comments]

   via reddit r/cybersecurity: Brevo supply-chain attack affected 100,000+ websites through compromised Cloudflare API key

7. mentioned by www.bleepingcomputer.com

   # Brevo supply-chain attack injected # ClickFix scripts on customer sites https://www. bleepingcomputer.com/news/secu rity/brevo-supply-chai

   www.bleepingcomputer.com · 24d ago · September 19th, 2026