Brevo supply chain attack pushed malware to over 100,000 websites

16 Sep 2026

On 14 September, attackers turned the email marketing platform Brevo into a malware distribution channel. For around five and a half hours, more than 100,000 websites that embed Brevo’s JavaScript widgets served malicious code to their visitors, in what is being described as one of the biggest web supply chain attacks of the year.

The attacker did not breach Brevo’s servers directly. They used a stolen Cloudflare API key, which had been hardcoded into Brevo’s application source code with full account permissions, to deploy a malicious Cloudflare Worker that rewrote responses at the CDN edge. The Worker injected a “ClickFix” script into three JavaScript files that customers embed on their own sites. Selected visitors saw a fake “verify you are human” page instructing them to paste and run a command on their own computer. On WordPress sites the script went further: if the visitor was logged in as an administrator, it attempted to install a backdoor plugin using their session.

Brevo removed the Worker and revoked the key the same evening, but researchers at Sansec found the key had first been misused in late August. The lesson for site owners is uncomfortable: any third party script on your pages runs with the full authority of your site, and your security is only as good as theirs. It is worth auditing what you embed, removing anything you no longer need, and treating admin sessions with the same care as any other privileged access.

Our web application testing service includes a review of third party scripts and the exposure they create. Contact BrightStrike to find out more.