Brevo: a stolen Cloudflare API key let an attacker rewrite Brevo pages and widget scripts at the CDN edge, serving ClickFix malware and a WordPress backdoor plugin
Brevo's own integrity checks never saw the tampering because the attacker rewrote pages at Cloudflare's edge, not on Brevo's servers
Defender actions
- On every WordPress site that loaded a Brevo forms, Conversations or SDK script on 2026-09-14 and had an administrator visit while logged in, check for any plugin installed or activated that day and compare the plugin directory on disk with the admin plugin list, because the known backdoor (impersonating "Web Media Optimizer") hides from that list and copies itself into the must-use-plugins directory. Remove any such plugin, invalidate all administrator sessions, change administrator passwords and review administrator accounts, because its hardcoded key mints admin logins without a password.
Analysis
Brevo (CRM/email-marketing platform, formerly Sendinblue) confirmed in a 2026-09-17 post-mortem that an attacker used a long-lived Cloudflare API key with full account permissions, hardcoded in Brevo's application source code, to create a malicious Cloudflare Worker on Brevo's own account, first misused as early as late August 2026 (Brevo, 2026-09-17). Brevo's own stated impact window ran 15:01 to 20:30 UTC on 2026-09-14 (5 hours 29 minutes), during which the Worker rewrote HTTP responses at the CDN edge on brevo.com and related domains, stripping security headers such as Content-Security-Policy; from 16:07 UTC the Worker additionally appended a malicious loader to three JavaScript files, the Brevo forms script, the Conversations widget and the SDK loader, that customers embed directly on their own sites, and extended the tampering to sibforms.com (Brevo, 2026-09-17). Because the edge rewrite never touched an origin file, Brevo's own standard integrity checks did not detect the change (Brevo, 2026-09-17). Visitors saw a fake Cloudflare human-verification page instructing them to press Win+R, paste and press Enter, a ClickFix lure that ran an attacker-supplied clipboard command to download Windows malware (Brevo, 2026-09-17), and did not activate for crawlers, developers or automated scanners (Sansec, 2026-09-16). On WordPress sites embedding an affected widget, a logged-in administrator's browser was used to attempt the install of a plugin impersonating "Web Media Optimizer" that hides itself from the plugin list, persists via the must-use-plugins directory, beacons to an attacker server for a Base64-encoded next-stage JavaScript URL, caches the last-valid URL as a fallback, and carries a hardcoded authentication key that lets the attacker generate a valid WordPress-administrator login session without the account password (BleepingComputer, 2026-09-17). Before Brevo's confirmation, Sansec named a breach of Brevo's Cloudflare account as the possible root cause, citing hints such as modified assets that kept the same Last-Modified dates before, during and after the incident. It also found that a certificate for an attacker-created host under a Brevo-owned domain was issued on 2026-08-25, which it says shows the attacker had write access to Brevo's DNS records (Sansec, 2026-09-16). Sansec states that Brevo "served malware to visitors of its own site and more than 100 thousand customer sites", linking the figure to a public source-code search for pages that mention Brevo's domains (Sansec, 2026-09-16). BleepingComputer reports the same research as up to 100,000 websites that use the affected Brevo components (BleepingComputer, 2026-09-17), so the two outlets frame the figure differently, as a floor and as a ceiling. Brevo's post-mortem does not mention a separate SSO-related incident (Brevo, 2026-09-17). BleepingComputer reports that Brevo disclosed that incident on 2026-09-10, that attackers hijacked customer accounts and launched phishing that reached Trezor customers, and that Brevo did not respond to its question about whether the two incidents were connected (BleepingComputer, 2026-09-17).
Triage: a legitimate Brevo or Sendinblue widget script served from its normal CDN path is expected, so the discriminator is behavioral, not path-based. A fake human-verification overlay instructing a clipboard-paste-and-run action is never legitimate CDN content. On WordPress, the compromise signs Sansec gives are a plugin installed or activated on 14 September, a plugin on disk that the admin screen does not list, and an access-log POST to /wp-admin/update.php?action=upload-plugin that day followed shortly by a plugin activation request (Sansec, 2026-09-16). BleepingComputer names the known backdoor plugin "Web Media Optimizer" (BleepingComputer, 2026-09-17).
Cited evidence
A long-lived Cloudflare API key with full account permissions was stored in application source code and was obtained by the attacker. With it, they could create Workers, routes and DNS records on Brevo's zones without triggering an alert.
Because the Worker rewrote responses at the edge and removed security headers such as Content-Security-Policy, our origin servers and files remained unmodified and standard integrity checks did not detect the change.
The plugin also stores a backup copy of the last valid JavaScript URL so it can continue loading malicious code if the remote server becomes unavailable.
the plugin contains a hardcoded authentication key that allows attackers to generate a valid login session for a WordPress administrator account without knowing the account password.
Updates2
Sansec's count is a floor, not a ceiling. Its write-up states that on 14 September "Brevo served malware to visitors of its own site and more than 100 thousand customer sites", linking that figure to a public source-code search for pages that mention Brevo's domains (Sansec, 2026-09-16). The figure was previously described as an upper bound of up to 100,000 sites, which understates the reach Sansec reported.
The compromise checks Sansec gives for WordPress sites are a plugin installed or activated on 14 September and a plugin on disk that the admin screen does not list (Sansec, 2026-09-16), and BleepingComputer names the backdoor plugin "Web Media Optimizer" (BleepingComputer, 2026-09-17).
Sansec states that Brevo served malware to visitors of more than 100,000 customer sites and links the figure to a public source-code search for pages that mention Brevo's domains (Sansec, 2026-09-16). BleepingComputer reports it as up to 100,000 websites that use the affected Brevo components (BleepingComputer, 2026-09-17). Sansec presents the Cloudflare-account breach as a possible root cause supported by hints, not as a confirmed finding (Sansec, 2026-09-16).
Sources3
Revision history
- Published 2026-09-18T0410Z-intel
- Correction 2026-09-20T1308Z-audit
The scope figure was inverted. Sansec reports that Brevo served malware to visitors of its own site and more than 100,000 customer sites; the title, summary and analysis all said "up to 100,000" and the analysis called it an upper bound. It is a floor, so the entry understated the reported reach. The title, summary and the body sentence now state what Sansec states.
Changed: title summary body
- Correction 2026-09-30T0639Z-audit
The action was generic third-party-script monitoring advice that restated the takeaway. It is replaced by the compromise check Brevo, Sansec and BleepingComputer give for WordPress sites that embedded the affected scripts. The priority moves from high to notable because a Swiss public body is exposed only if its site embedded Brevo widgets during a closed 5.5-hour window. The triage line treated every plugin missing from the admin list but present in the must-use-plugins directory as compromised, and now gives Sansec's checks and the plugin name. The title is shortened, the 100,000 figure is stated as Sansec and BleepingComputer each frame it, and Sansec's root-cause assessment keeps its hedge. An exposure line adds Brevo's guidance for anyone who ran the pasted command or logged in to Brevo that day.
Changed: priority actions body title summary
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.