In short: On September 14, 2026, attackers exploited a hardcoded Cloudflare API key in Brevo's source code to deploy a malicious Worker that injected ClickFix scripts into approximately 100,000 websites for 5.5 hours. Visitors were shown fake Cloudflare verification pages and tricked into running a malware-download command. WordPress administrators were targeted with a hidden backdoor plugin. If you visited a site with Brevo widgets that evening, check your device now.
What happened
The incident unfolded in two stages. On September 10, 2026, threat actors exploited a SAML SSO vulnerability at Brevo and compromised 138 customer accounts, including that of Trezor, the well-known hardware cryptocurrency wallet maker. Contact list data was accessed and phishing emails were sent from six of those hijacked accounts.
The larger attack followed on September 14. Between 16:07 and 20:30 UTC, attackers deployed a malicious Cloudflare Worker that intercepted and modified CDN responses at the edge — before they ever reached a user's browser. Brevo's own origin files remained untouched throughout, which is precisely what made the attack difficult to detect quickly.
How one stolen key unlocked 100,000 sites
The attack hinged on a single mistake: a long-lived Cloudflare API key with full account permissions that was hardcoded directly into Brevo's application source code. This is a classic secrets management failure. Rather than storing credentials in a dedicated vault such as HashiCorp Vault, they were embedded in code — meaning anyone who gained access to that code automatically gained access to the entire Cloudflare infrastructure.
With that key, the attackers created Cloudflare Workers — lightweight scripts executed on Cloudflare's global edge network. They used a Worker to intercept three JavaScript files that Brevo customers embed on their own websites: the forms library, the Conversations widget, and the SDK loader. The substitution happened at the CDN layer, bypassing integrity checks on Brevo's origin servers. The Worker also deliberately stripped Content-Security-Policy headers, removing the browser-level protection that could have blocked the injected code from executing.
What users saw on affected sites
Visitors to sites running Brevo widgets encountered a fake verification page: "Cloudflare, please verify you are human." It closely mimicked a legitimate Cloudflare Turnstile challenge. But instead of an automatic check, it instructed users to press Win+R, paste a supplied command into the Run dialog, and press Enter. This social engineering technique, known as ClickFix, caused the machine to execute a PowerShell script that downloaded and installed malware.
For WordPress administrators visiting their sites' dashboards, the script attempted to silently install a plugin called "Web Media Optimizer." The plugin hid itself from the standard WordPress plugin list and created persistent admin sessions using embedded credentials — a fully functional backdoor for long-term access.
Scale and data at risk
Security firm Sansec, which discovered the campaign, confirmed over 100,000 websites were affected. Not every visitor was necessarily infected: the ClickFix payload required a user to manually execute a command on Windows, and the WordPress backdoor required admin access. But the scope of potential exposure is substantial.
Brevo is one of the world's largest email marketing platforms, with widgets embedded across e-commerce stores, media sites, SaaS products, and small businesses globally. Users who ran the ClickFix command risk having passwords, session tokens, and locally stored credentials stolen. WordPress sites that received the hidden plugin may remain compromised if administrators haven't yet audited their installations. This attack fits a growing pattern of software supply-chain threats; we covered a similar vector in our article on the Mercor LiteLLM supply chain breach of 2026. For a broader overview, see our privacy blog.
Brevo's response
Once the attack was detected, Brevo revoked the compromised API key, deleted the malicious Worker and all associated routes, cleared CDN edge caches, and removed attacker-controlled hostnames. The company also removed hardcoded credentials from its source code and announced a transition to HashiCorp Vault for secrets management.
By September 15, all malicious subdomains had stopped resolving and Brevo files had returned to a clean state. Brevo notified customers whose accounts were compromised in the initial September 10 breach and recommended all site owners audit their WordPress installations for unauthorized plugins.
What to do if you were affected
If you visited any website with Brevo widgets on September 14 between 16:07 and 20:30 UTC: recall whether you saw an unusual "verification" page asking you to run a command. If you followed those instructions, run a full malware scan immediately and change passwords for any critical accounts from a different device.
If you run a WordPress site with a Brevo widget: check all installed plugins via WP-CLI, FTP, or phpMyAdmin — not just the standard WordPress admin interface, as the backdoor hid from that view. Look for any plugin named "Web Media Optimizer" or an unfamiliar plugin added on September 14–15.
For everyone going forward: legitimate Cloudflare Turnstile checks never ask you to run terminal commands or Win+R dialogs — that is always a scam. A password manager will not autofill credentials on a lookalike page. When using public Wi-Fi, an encrypted tunnel like LiMP VPN prevents anyone on the same network from intercepting your active sessions. See our plans page for details.