Stolen Cloudflare Key Turned Brevo Widgets Into a ClickFix Delivery Channel

Brevo has confirmed a supply-chain compromise that allowed attackers to inject malicious content into company-hosted pages and JavaScript components embedded across customer websites.

The operation did not require modifying Brevo’s origin servers. Instead, the attackers used a stolen Cloudflare API key to create a malicious Worker, rewriting HTTP responses as they passed through Cloudflare’s edge network.

The unauthorized changes remained active for roughly five and a half hours on September 14, 2026. Security firm Sansec estimated that as many as 100,000 websites using affected Brevo components may have been exposed, although exposure does not necessarily mean that every site or visitor was compromised.

Edge-level tampering affected Brevo pages and embedded scripts

Brevo identified the primary exposure window as 16:07–20:30 UTC on September 14. Sansec reported a slightly different interval, from 16:05 to 20:13 UTC.

The affected pages included content delivered through:

• brevo.com
• sendinblue.com
• login/account/my/onboarding.brevo.com
• sibforms.com

The compromise also reached Brevo resources loaded by third-party websites, including the Brevo forms script, Brevo Conversations widget, and Brevo SDK loader scripts. Specific component versions have not been disclosed.

This expanded the attack beyond people directly browsing Brevo properties. Any customer website loading one of the manipulated components could become an indirect delivery point for the attackers’ code.

Brevo said several core systems were unaffected, including app.brevo.com, its API, email-delivery infrastructure, and customer account data. There is no indication that the attackers modified content stored on Brevo’s origin servers.

Sansec later reported that the malicious subdomains had stopped resolving on September 15 and that the affected Brevo files had been cleaned.

A hardcoded Cloudflare credential enabled the compromise

The attackers obtained a long-lived Cloudflare API key that had been hardcoded into application source code. The credential carried full account permissions rather than narrowly limited access.

Those permissions enabled the creation of Cloudflare Workers, routing rules, and DNS records across Brevo’s zones. According to Brevo, this activity did not trigger an alert.

The attackers then deployed a Worker capable of intercepting and rewriting responses at the CDN edge. The Worker also stripped defensive HTTP headers, including Content-Security-Policy, which would otherwise restrict the scripts and resources that a browser may execute.

This architecture explains why conventional file-integrity controls did not detect the injected content. Brevo’s hosted files remained unchanged while visitors received altered responses from Cloudflare’s infrastructure.

The credential may have been exposed as early as late August. Brevo said it found no evidence of malicious use before the September 14 attack window, however.

Following detection, the company removed the malicious Worker and associated routes, revoked the stolen key, and invalidated credentials created through it. Brevo also removed the hardcoded secret from its source code, deleted attacker-controlled hostnames, and purged cached edge content.

Fake Cloudflare checks pushed Windows users toward ClickFix

Visitors receiving the modified content were shown a counterfeit Cloudflare verification page. The lure then presented ClickFix instructions intended to convince Windows users to run a command themselves.

ClickFix attacks rely on social engineering rather than a direct browser exploit. A victim is told that completing a verification, fixing an error, or passing a security check requires copying and executing a command. Following those instructions can lead to malware installation.

The available information does not identify the exact command displayed during this campaign or the final Windows payload. It therefore remains unclear which malware families were delivered to users who completed the steps.

The technique has also appeared in other website compromise campaigns. A separate operation recently used fake verification prompts on thousands of compromised WordPress and PrestaShop sites, demonstrating how broadly these lures can be distributed once trusted web resources are altered.

WordPress administrators faced a persistent backdoor

The injected code performed additional checks on WordPress sites running an affected Brevo widget. In particular, it attempted to determine whether the current visitor was authenticated as an administrator.

When that condition was met, the code tried to download a malicious plugin archive from:

https://cdn10.sendibt1[.]com/p/wm.zip

Sansec could not retrieve the archive during its investigation. However, a copy located on VirusTotal showed that the package impersonated a plugin called Web Media Optimizer.

Its actual purpose was to provide persistence, load remote JavaScript, and give the attackers continued access. Related infrastructure used to distribute the plugin or associated scripts included:

• https://yelahaye[.]surf
• https://boiseno[.]club

After installation, the plugin concealed itself from the standard WordPress plugin list. It also copied itself into the must-use plugins directory, where WordPress automatically loads plugins without requiring normal activation.

The backdoor periodically contacted:

https://glegchner.com/ads.php

At the time of analysis, that endpoint returned a Base64-encoded address resolving to:

https://corralos[.]beer/a412dkoq.js

JavaScript from that location was injected into visitor-facing pages to display another ClickFix lure. The plugin retained a backup of the most recently valid JavaScript URL, allowing it to continue loading malicious code if the control server became temporarily unavailable.

More seriously, the plugin contained a hardcoded authentication key. Attackers possessing that key could generate a valid WordPress administrator session without knowing the administrator’s password. Password rotation alone may therefore be insufficient while the plugin remains installed.

Site owners should check plugins, edge configuration, and credentials

WordPress administrators who visited an affected site while logged in on September 14 should inspect all plugins installed or activated that day. The review must include the must-use plugins directory, because the malicious package may not appear in the normal dashboard list.

Defenders should search for Web Media Optimizer, the listed domains and URLs, unexpected PHP files, and unfamiliar administrator sessions. Any suspicious plugin should be removed immediately, followed by rotation of administrator passwords and termination of existing sessions.

Organizations using Brevo components should also:

• Inspect pages and templates for affected Brevo forms, Conversations, and SDK loader scripts.
• Review Cloudflare Worker creation, modification, and routing activity.
• Examine DNS changes and newly created hostnames.
• Audit API-key usage and credentials generated through privileged tokens.
• Revoke potentially exposed keys instead of relying only on rotation schedules.
• Remove secrets embedded in source code and deployment artifacts.
• Purge CDN and application caches after confirming that malicious routes are gone.
• Search network, proxy, DNS, and web logs for the identified infrastructure.
• Investigate users who encountered Cloudflare-style verification prompts and subsequently executed commands.

No infection count has been disclosed. Sansec’s estimate of up to 100,000 exposed websites describes the possible distribution footprint, not the number of successful plugin installations or Windows compromises.

The incident follows a separate Brevo account-hijacking campaign

The Cloudflare compromise arrived shortly after another security incident involving Brevo. On September 10, the company disclosed an SSO-related campaign in which attackers hijacked customer accounts and used them to send phishing messages.

Cryptocurrency-wallet provider Trezor reported on September 11 that the campaign reached 347,000 user email addresses and resulted in at least 2,500 compromised accounts.

Brevo has not confirmed whether that account-hijacking activity was connected to the stolen Cloudflare API key. Without evidence linking the operators, infrastructure, or access methods, the two incidents must be treated as separate investigations.

The latest compromise nevertheless exposes a high-impact trust boundary: a single overprivileged CDN credential enabled attackers to manipulate content across Brevo-controlled domains and potentially thousands of customer sites, while leaving the original files untouched.