Attackers breached Brevo and used a stolen Cloudflare API key to inject malicious code into Brevo-hosted scripts that thousands of customer websites load. Visitors saw a fake “prove you’re human” prompt meant to trick them into running a command, and logged-in WordPress admins risked having a malicious plugin installed through their active session. The incident briefly turned Brevo’s trusted web scripts into a large-scale malware distribution channel, potentially affecting over 100,000 sites.
Attackers first exploited a vulnerability in Brevo's SAML SSO to gain access to 138 accounts. Six of those accounts were used to send phishing emails, while contact data was exported from 43 others. Separately, attackers obtained a compromised, long-lived Cloudflare API key and used it to deploy a malicious Cloudflare Worker. This let them inject code at the CDN edge, bypassing the origin integrity checks that would normally catch tampering on Brevo's own servers.
This is significant because Brevo's chat widget and tracking scripts are loaded directly from cdn.brevo.com by thousands of websites. The injected code modified these trusted scripts to load an additional script from a separate domain, turning a routine third-party widget into a distribution point for malware. Sansec estimated more than 100,000 customer sites were served this malware on a single day.
The attack succeeded because it operated at the edge, outside the visibility of the site owners and outside Brevo's own server integrity checks. Files on Brevo's servers stayed clean the entire time, meaning normal server-side monitoring would not have caught the injection. Visitors and site admins had no reason to distrust a widget or script coming from a platform they already trusted.
The social engineering layer added another obstacle: a fake 'prove you're human' prompt is a familiar, low-friction interaction that most people don't second-guess, making it an effective way to get users to run a command themselves.
Teams should treat 'prove you're human' prompts that request terminal commands as an immediate red flag and report them rather than complying. Any machine where someone pasted a verification command because a website asked should be scanned. Web administrators should compare what's actually on disk against what the WordPress admin plugin list shows, since malicious plugins can hide from that list. Organizations relying on third-party scripts and widgets should also build awareness that supply-chain incidents at a vendor can affect their own site even when their own infrastructure is untouched, and should coordinate any domain-blocking decisions carefully since some vendor domains support legitimate functions like email tracking.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers exploited a vulnerability in Brevo's SAML SSO to access 138 accounts, then used a compromised Cloudflare API key to inject malicious code into Brevo's widely loaded scripts, potentially affecting over 100,000 customer sites.
It was a clickfix overlay shown to site visitors or people clicking unsubscribe links in Brevo-sent emails, designed to trick them into pasting and running a malicious command in their terminal.
If a logged-in WordPress admin visited their own compromised site, a malicious plugin could be installed through their active session without needing a password, and the plugin hid itself from the normal plugin list.
Treat any prompt asking users to run terminal commands as malicious, scan any machine where a command was pasted, check for hidden WordPress plugins beyond the admin list, and coordinate carefully before blocking vendor domains used for legitimate tracking.
Imagine clicking an unsubscribe link, and the site suddenly says: “prove you’re human” by running a command on your computer. That really happened. Brevo was breached, and a stolen Cloudflare API key let attackers inject malware into scripts from cdn.brevo.com, silently loading extra code from sendibt1.com on over a hundred thousand sites. Visitors got a clickfix overlay, that fake “prove you’re human” prompt. The twist: it told people to paste a ‘verification’ command into Terminal, and if a logged‑in WordPress admin visited their own site, a hidden malicious plugin could install itself through their active session. Here’s the rule: if any website ever tells you to run a command to ‘prove you’re human’ or ‘verify’ yourself, stop immediately and report it to Security, do not paste that command, even once.
Brevo suffered a supply-chain compromise where attackers injected malicious JavaScript into Brevo-hosted pages and customer-embedded website scripts, affecting over 100,000 sites. Visitors were shown a fake “Cloudflare, verify you are human” prompt designed to trick them into running a command on…
Attackers broke into Brevo, the email platform Trezor uses for newsletters, and sent a phishing “security warning” from Trezor’s real mailing system. The email claimed a serious hardware issue could expose wallet recovery seeds and pushed people to a malicious site/app that asked for a wallet…
Attackers abused access to Brevo (an email marketing platform) to send highly convincing phishing emails from legitimate cryptocurrency company domains to newsletter subscribers. The lures claimed urgent security issues (hardware vulnerability or data breach) and pushed victims to click links,…
Attackers compromised HBO Max’s verified Reddit advertising account and used it to run 108 malicious ads in about 48 hours. The ads sent people to attacker-controlled websites that used “ClickFix” instructions to trick users into running commands that installed malware on Windows and macOS.
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
