Brevo Hack Served ClickFix Malware to 100K Sites

Brevo suffered a supply-chain compromise where attackers injected malicious JavaScript into Brevo-hosted pages and customer-embedded website scripts, affecting over 100,000 sites. Visitors were shown a fake “Cloudflare, verify you are human” prompt designed to trick them into running a command on their computer (a ClickFix-style scam). On WordPress sites, the injected code also tried to install a plugin when an admin was logged in.

Key findings

• Brevo was first breached on September 10 via an issue in how it handled SAML SSO, leading to access to 138 accounts.
• Attackers used six compromised accounts to send phishing emails and exported contacts from 43 accounts.
• On September 14, attackers reused a compromised long-lived Cloudflare API key to deploy a worker that injected malicious scripts into Brevo domains and customer-embedded JavaScript files.
• Injected code showed some visitors a fake “Cloudflare, verify you are human” page that instructed them to paste and run a command (ClickFix).
• On WordPress sites embedding a Brevo widget, the script attempted to deploy and run a plugin if the visitor was logged in as an administrator.
• Sansec estimates the malicious content was served for roughly four hours and likely impacted more than 100,000 websites.

Who’s being targeted

• Commonly targeted roles: All employees (end users/browsers), Web Administrators, IT/Security Operations, Marketing/Website owners using third-party widgets.
• Affected industries: Information technology / SaaS, E-commerce websites, Marketing and customer engagement websites, Cryptocurrency services, Any organization operating a WordPress website.
• Attack channels: website.
• Impersonated: Cloudflare verification page, Website plugin/update mechanism (implied by plugin installation attempt).

Awareness takeaways

• Train users: never run copy/pasted commands from a web page pop-up, even if it looks like a well-known brand (e.g., Cloudflare).
• For web/IT teams: regularly review WordPress sites for unauthorized plugins and unexpected changes to embedded scripts/widgets from third parties.
• Assume third-party platforms can be abused: add monitoring/alerting for changes to critical API keys and edge-worker deployments.

Red flags to watch for

• A security check asking you to run a command on your computer is not normal.
• Unexpected verification page appears while browsing a legitimate site.
• Instructions involve copying/pasting commands rather than using standard CAPTCHA/checkbox challenges.
• Unexpected new plugin installed or plugin list changes without approval.
• Admin activity or prompts occurring when simply viewing pages with embedded widgets.
• Unrecognized code changes in embedded JavaScript files/widgets.