Brevo supply chain attack injects malware into over 100,000 customer websites

A supply chain attack on marketing platform Brevo injected malicious scripts into more than 100,000 customer websites on September 14, exposing visitors to fake CAPTCHA prompts designed to trick them into running malware, and planting a hidden backdoor plugin on WordPress sites whose administrators were logged in at the time.

Brevo — formerly known as Sendinblue — provides embeddable forms, chat widgets, and email SDKs that thousands of businesses load directly into their own websites. That embedding is exactly what turned a breach of one company into an attack surface spanning six figures of unrelated sites: when Brevo's own scripts were compromised, every site loading them served the malicious code automatically, with no separate breach of the site owners required.

The attackers first gained access by exploiting a vulnerability in Brevo's SAML single sign-on handling, compromising 138 customer accounts — including one belonging to hardware crypto wallet maker Trezor, which later reported that roughly 347,000 of its users were targeted and more than 2,500 accounts were compromised as a downstream consequence. Investigators trace initial access to late August, but the damaging phase began on September 14, when the attackers used a long-lived Cloudflare API key — hardcoded directly in Brevo's application source code with full account permissions — to deploy a malicious Cloudflare Worker. For roughly five and a half hours, that Worker rewrote content served from brevo.com, sibforms.com, and the company's forms, widget, and SDK scripts at the CDN edge, before Brevo detected and removed it the next day.

Two payloads went out during that window. Site visitors saw "ClickFix" pages: fake Cloudflare verification prompts instructing them to open the Windows Run dialog and paste a command, a well-established social engineering technique that leads to malware execution when followed. Separately, any WordPress site with a logged-in administrator during the attack window received a malicious plugin called "Web Media Optimizer," which hid itself from the visible plugins list, installed itself persistently through WordPress's must-use plugins directory, and included hardcoded credentials granting the attackers admin access without a password — a backdoor that survives even after the original injection point is cleaned up.

Brevo has since revoked the compromised API key, removed the hardcoded credentials from its source code, deleted the malicious Worker and its routing rules, purged CDN edge caches, and blocked the attacker-controlled domains the malware called out to. But the WordPress backdoor plugin doesn't disappear on its own — any site that had an admin logged in during the five-and-a-half-hour window needs to independently check for and remove the "Web Media Optimizer" plugin, since Brevo fixing its own infrastructure does nothing to close a backdoor already planted on someone else's server.

The incident is a reminder of how concentrated risk has become in the small number of third-party scripts most websites load without a second thought. A single hardcoded API key sitting in one company's source code turned into a five-hour window that reached more websites than most individual data breaches ever touch — and the fix isn't complete until every affected site owner independently audits their own WordPress installation, not just when Brevo's dashboard says the incident is resolved.