Brevo says attackers used a stolen Cloudflare API key to tamper with Brevo web pages and JavaScript files that customers embed on their own sites, exposing visitors to fake verification prompts and malware. The attackers created a malicious Cloudflare Worker that rewrote content at the content-delivery edge for about five and a half hours on September 14, 2026, affecting brevo.com, sendinblue.com, sibforms.com, Brevo forms, Conversations widgets, and SDK loader scripts. On some WordPress sites, the injected code also tried to install a hidden backdoor plugin that fetched and injected additional ClickFix scripts.
Why it matters: Organizations using Brevo web widgets or scripts should treat this as a supply-chain incident and urgently check websites for unauthorized script changes, malicious WordPress plugins, and visitor exposure during the attack window. End users who saw fake Cloudflare checks or ran prompted commands may have infected their devices and should investigate immediately.
Bill Toulas
2026.09.17
100% relevant
This article appears to be the first concrete report establishing a distinct Brevo supply-chain compromise involving a stolen Cloudflare API key, edge-side script injection, and ClickFix malware delivery to customer sites.
← Back to all stories