CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Brevo Cloudflare Worker / ClickFix supply-chain compromise (September 2026)

incident · incident:brevo-cloudflare-worker-clickfix-supply-chain-2026-09

A stolen, hardcoded long-lived Cloudflare API key let an attacker deploy a malicious Cloudflare Worker rewriting Brevo's own pages and customer-embedded widget scripts at the CDN edge for roughly 5.5 hours on 2026-09-14, serving ClickFix malware and a WordPress admin backdoor plugin to up to 100,000 sites, without modifying any origin file (Brevo, Sansec, 2026-09-17).

Coverage
1
first 2026-09-18 → last 2026-09-30
Latest activity
2026-09-18
Brevo's own integrity checks never saw the tampering because the attacker rewrote pages at Cloudflare's edge…
Peak priority
notable
1 notable
Targets
technology
sectors: technology
Sources cited
3
3 hosts

Action items (1)

Do-now tasks recorded on the entries about Brevo Cloudflare Worker / ClickFix supply-chain compromise (September 2026), newest first. Check the date before acting on an older one.

  • On every WordPress site that loaded a Brevo forms, Conversations or SDK script on 2026-09-14 and had an administrator visit while logged in, check for any plugin installed or activated that day and compare the plugin directory on disk with the admin plugin list, because the known backdoor (impersonating "Web Media Optimizer") hides from that list and copies itself into the must-use-plugins directory. Remove any such plugin, invalidate all administrator sessions, change administrator passwords and review administrator accounts, because its hardcoded key mints admin logins without a password.
    2026-09-18Brevo's own integrity checks never saw the…

Defender insights

What each entry about Brevo Cloudflare Worker / ClickFix supply-chain compromise (September 2026) tells a defender to do, newest first.

2026-09-18NOTABLEBrevo's own integrity checks never saw the tampering because the attacker rewrote pages at Cloudflare's edge, not on Brevo's servers

Exposure · triage

Story timeline

  1. 2026-09-18Brevo: a stolen Cloudflare API key let an attacker rewrite Brevo pages and widget scripts at the CDN edge, serving ClickFix malware and a WordPress backdoor plugin
    active-threatsBrevo's own integrity checks never saw the tampering because the attacker rewrote pages at Cloudflare's edge, not on Brevo's servers

Hunting pivots

Affected products
Brevo
Tags
phishingsupply-chain
ATT&CK techniques (4 across 6 tactics)

4 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts: Cloud Accounts · Supply Chain Compromise: Compromise Software Supply Chain
  • ExecutionUser Execution: Malicious Copy and Paste
  • PersistenceValid Accounts: Cloud Accounts
  • Privilege EscalationValid Accounts: Cloud Accounts
  • StealthValid Accounts: Cloud Accounts
  • Credential AccessUnsecured Credentials: Credentials In Files

Initial Access TA0001

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-09-18/brevo-cloudflare-worker-clickfix-supply-chain · ATT&CK page ↗

T1195.002Supply Chain Compromise: Compromise Software Supply Chain×1

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.

Evidence: 2026-09-18/brevo-cloudflare-worker-clickfix-supply-chain · ATT&CK page ↗

Execution TA0002

T1204.004User Execution: Malicious Copy and Paste×1

An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions (such as prompts to fix errors or complete CAPTCHAs) that instead instruct the user to copy and paste malicious code.

Evidence: 2026-09-18/brevo-cloudflare-worker-clickfix-supply-chain · ATT&CK page ↗

Persistence TA0003

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-09-18/brevo-cloudflare-worker-clickfix-supply-chain · ATT&CK page ↗

Privilege Escalation TA0004

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-09-18/brevo-cloudflare-worker-clickfix-supply-chain · ATT&CK page ↗

Stealth TA0005

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-09-18/brevo-cloudflare-worker-clickfix-supply-chain · ATT&CK page ↗

Credential Access TA0006

T1552.001Unsecured Credentials: Credentials In Files×1

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Evidence: 2026-09-18/brevo-cloudflare-worker-clickfix-supply-chain · ATT&CK page ↗

Entries about Brevo Cloudflare Worker / ClickFix supply-chain compromise (September 2026) (1)

2026-09-18 · view entry permalink →

NOTABLEupdatedNATOA1

Brevo: a stolen Cloudflare API key let an attacker rewrite Brevo pages and widget scripts at the CDN edge, serving ClickFix malware and a WordPress backdoor plugin

Brevo (CRM/email-marketing platform, formerly Sendinblue) confirmed in a 2026-09-17 post-mortem that an attacker used a long-lived Cloudflare API key with full account permissions, hardcoded in Brevo's application source code, to create a malicious Cloudflare Worker on Brevo's own account, first misused as early as late August 2026 (Brevo, 2026-09-17). Brevo's own stated impact window ran 15:01 to 20:30 UTC on 2026-09-14 (5 hours 29 minutes), during which the Worker rewrote HTTP responses at the CDN edge on brevo.com and related domains, stripping security headers such as Content-Security-Policy; from 16:07 UTC the Worker additionally appended a malicious loader to three JavaScript files, the Brevo forms script, the Conversations widget and the SDK loader, that customers embed directly on their own sites, and extended the tampering to sibforms.com (Brevo, 2026-09-17). Because the edge rewrite never touched an origin file, Brevo's own standard integrity checks did not detect the change (Brevo, 2026-09-17). Visitors saw a fake Cloudflare human-verification page instructing them to press Win+R, paste and press Enter, a ClickFix lure that ran an attacker-supplied clipboard command to download Windows malware (Brevo, 2026-09-17), and did not activate for crawlers, developers or automated scanners (Sansec, 2026-09-16). On WordPress sites embedding an affected widget, a logged-in administrator's browser was used to attempt the install of a plugin impersonating "Web Media Optimizer" that hides itself from the plugin list, persists via the must-use-plugins directory, beacons to an attacker server for a Base64-encoded next-stage JavaScript URL, caches the last-valid URL as a fallback, and carries a hardcoded authentication key that lets the attacker generate a valid WordPress-administrator login session without the account password (BleepingComputer, 2026-09-17). Before Brevo's confirmation, Sansec named a breach of Brevo's Cloudflare account as the possible root cause, citing hints such as modified assets that kept the same Last-Modified dates before, during and after the incident. It also found that a certificate for an attacker-created host under a Brevo-owned domain was issued on 2026-08-25, which it says shows the attacker had write access to Brevo's DNS records (Sansec, 2026-09-16). Sansec states that Brevo "served malware to visitors of its own site and more than 100 thousand customer sites", linking the figure to a public source-code search for pages that mention Brevo's domains (Sansec, 2026-09-16). BleepingComputer reports the same research as up to 100,000 websites that use the affected Brevo components (BleepingComputer, 2026-09-17), so the two outlets frame the figure differently, as a floor and as a ceiling. Brevo's post-mortem does not mention a separate SSO-related incident (Brevo, 2026-09-17). BleepingComputer reports that Brevo disclosed that incident on 2026-09-10, that attackers hijacked customer accounts and launched phishing that reached Trezor customers, and that Brevo did not respond to its question about whether the two incidents were connected (BleepingComputer, 2026-09-17).

Triage: a legitimate Brevo or Sendinblue widget script served from its normal CDN path is expected, so the discriminator is behavioral, not path-based. A fake human-verification overlay instructing a clipboard-paste-and-run action is never legitimate CDN content. On WordPress, the compromise signs Sansec gives are a plugin installed or activated on 14 September, a plugin on disk that the admin screen does not list, and an access-log POST to /wp-admin/update.php?action=upload-plugin that day followed shortly by a plugin activation request (Sansec, 2026-09-16). BleepingComputer names the known backdoor plugin "Web Media Optimizer" (BleepingComputer, 2026-09-17).

A long-lived Cloudflare API key with full account permissions was stored in application source code and was obtained by the attacker. With it, they could create Workers, routes and DNS records on Brevo's zones without triggering an alert.

Because the Worker rewrote responses at the edge and removed security headers such as Content-Security-Policy, our origin servers and files remained unmodified and standard integrity checks did not detect the change.

Brevo 2026-09-17

The plugin also stores a backup copy of the last valid JavaScript URL so it can continue loading malicious code if the remote server becomes unavailable.

the plugin contains a hardcoded authentication key that allows attackers to generate a valid login session for a WordPress administrator account without knowing the account password.

BleepingComputer 2026-09-17
Correctionrun 2026-09-20T1308Z-audittitlesummarybody

Sansec's count is a floor, not a ceiling. Its write-up states that on 14 September "Brevo served malware to visitors of its own site and more than 100 thousand customer sites", linking that figure to a public source-code search for pages that mention Brevo's domains (Sansec, 2026-09-16). The figure was previously described as an upper bound of up to 100,000 sites, which understates the reach Sansec reported.

Correctionrun 2026-09-30T0639Z-auditpriorityactionsbodytitlesummary

The compromise checks Sansec gives for WordPress sites are a plugin installed or activated on 14 September and a plugin on disk that the admin screen does not list (Sansec, 2026-09-16), and BleepingComputer names the backdoor plugin "Web Media Optimizer" (BleepingComputer, 2026-09-17).

Sansec states that Brevo served malware to visitors of more than 100,000 customer sites and links the figure to a public source-code search for pages that mention Brevo's domains (Sansec, 2026-09-16). BleepingComputer reports it as up to 100,000 websites that use the affected Brevo components (BleepingComputer, 2026-09-17). Sansec presents the Cloudflare-account breach as a possible root cause supported by hints, not as a confirmed finding (Sansec, 2026-09-16).

incident18 Sep 05:02Zmulti-sourceOpen finding →
Sources: Brevo · Sansec · BleepingComputer

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • bleepingcomputer.com1 (33%)
  • sansec.io1 (33%)
  • status.brevo.com1 (33%)
All cited sources (3)