Security Reports disagree 3 publishers 3 min read Published Sep 17, 2026, 10:42 AM PDT Updated Sep 18, 2026, 3:50 PM PDT

Attackers rewrote Brevo's embedded scripts at Cloudflare's edge with a hardcoded full-permission key

Brevo says a long-lived Cloudflare key with full account permissions sat in its application source code, and the Worker built with it stripped Content-Security-Policy headers from scripts that Sansec estimates reach 100,000 sites.

The Watch · Security desk

Send a correction

Illustration accompanying Attackers rewrote Brevo's embedded scripts at Cloudflare's edge with a hardcoded full-permission key — Generated illustration

What happened

Brevo confirmed that attackers stole a Cloudflare API key and used it to create a malicious Cloudflare Worker that modified content at the CDN edge for about five and a half hours on September 14.
The Worker altered pages on brevo.com, sendinblue.com and sibforms.com plus the Brevo forms script, the Conversations widget and the SDK loader scripts that customers embed on their own sites.
Sansec, which reported the incident first, said up to 100,000 websites use the affected Brevo components, and confirmed the malicious subdomains stopped resolving on September 15.
Visitors to affected pages were shown a fake Cloudflare verification page followed by ClickFix instructions urging them to run a command on Windows.

Why it matters

What's now possible capability File integrity monitoring on a vendor's origin tells you nothing about what its CDN serves, and a Content-Security-Policy header is no help when the code rewriting the response can delete the header.
Who's exposed exposure Any WordPress administrator who browsed an affected site while logged in on September 14 may be running a plugin that hides from the plugin list and mints administrator sessions without the password.
What doesn't add up contradiction Brevo's rounded duration is longer than the timestamps in its own advisory and longer than Sansec's observed window, so log review should be scoped to the timestamps rather than the summary figure.
Who has to decide decision With no public link between the SSO account hijacking and the Cloudflare key, customers weighing whether to keep Brevo script tags in their pages are deciding without knowing if one intruder had access or two.

Next story · Invest · yesterday

Bitquery counts $102 million drained from 324 Ledger-linked wallets across six chains

Confirmed6 publishers

A Cloudflare API key with full account permissions can create Workers, routes and DNS records across every zone on the account. Brevo says the key in its application source code was long-lived and did all three for the attackers without triggering an alert ^[4]. The Worker they built sat in front of the origin and edited what came out of it. "Because the Worker rewrote responses at the edge and removed security headers such as Content-Security-Policy, our origin servers and files remained unmodified and standard integrity checks did not detect the change," Brevo said in its post-mortem ^[7]. Anyone hashing files on Brevo's servers that afternoon would have found them correct.

The duration is unsettled. Brevo calls it approximately five and a half hours of edge modification ^[1] and elsewhere defines the exposure window as 16:07 to 20:30 UTC, a span of 4 hours 23 minutes ^[23]^[26]. Sansec dates the activity from 16:05 to 20:13 UTC, 4 hours 8 minutes ^[25]^[27]. Both observed windows run about an hour shorter than the figure in Brevo's own summary ^[28]. Brevo also says the key may have been exposed as early as late August, with no evidence of malicious use before September 14 ^[8].

On WordPress sites embedding an affected widget, the injected script checked whether the visitor was logged in as an administrator, then tried to upload wm.zip from cdn10.sendibt1[.]com ^[11]. BleepingComputer pulled a copy from VirusTotal and describes a plugin named "Web Media Optimizer" that works as a persistent backdoor and JavaScript loader ^[12]. It hides itself from the plugin list, copies itself into the must-use plugins directory, and polls glegchner.com/ads.php ^[13]. That server returns a Base64 string, currently decoding to corralos[.]beer/a412dkoq.js ^[14], and the plugin caches the last working URL so it keeps loading code if the server stops answering ^[15]. A hardcoded authentication key inside it generates a valid administrator session without the password ^[16]. BleepingComputer also saw the plugin and scripts served from yelahaye[.]surf and boiseno[.]club ^[20].

Brevo revoked the key, removed the credential from source, deleted attacker hostnames and purged its edge caches ^[9]. None of that touches an installed copy of the plugin, which persists locally and calls its own server ^[22].

Brevo says app.brevo.com, its API, email delivery infrastructure and customer account data were not affected ^[19]. If you do not embed the forms script, the Conversations widget or the SDK loader, and no administrator browsed an affected site on September 14, this one is closed for you ^[2]^[3]^[6].

This is Brevo's second disclosure in five days. On September 10 the company reported an SSO-related incident in which attackers hijacked customer accounts and ran phishing against those customers' users ^[5]. Trezor said on September 11 that the phishing reached 347,000 email addresses and compromised at least 2,500, about 0.7% ^[17]^[21]. Brevo did not answer BleepingComputer's questions about whether the two incidents are connected ^[18].

What to watch

Fresh distribution hosts for the fake plugin once yelahaye[.]surf and boiseno[.]club stop resolving.
Any named actor or shared infrastructure tying the September 10 SSO account hijacking to the Worker campaign.
Reports of unauthorised administrator logins on WordPress sites where the plugin's hardcoded key was used.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence78
Adoption60
Hype gap+20
Incentives58
Confidence72

Perspective Coverage

3 publishers

Builder: Builder 34%
Operator: Operator 48%
Investor: Investor 18%

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Brevo confirmed that attackers stole a Cloudflare API key and used it to create a malicious Cloudflare Worker that modified content at the CDN edge for approximately five and a half hours on September 14, injecting malicious ClickFix scripts into its websites and JavaScript files embedded on customer sites.
Reported SupportedView cited source
[2]
The attack affected pages on brevo.com, sendinblue.com, login/account/my/onboarding.brevo.com and sibforms.com.
Reported SupportedView cited source
[3]
The Cloudflare Worker also modified the Brevo forms script, the Brevo Conversations widget and the Brevo SDK loader scripts that customers embed on their websites.
Reported SupportedView cited source
[4]
In a post-mortem, Brevo said attackers obtained a long-lived Cloudflare API key with full account permissions that had been hardcoded in application source code, which allowed them to create Cloudflare Workers, routes and DNS records across Brevo's zones without triggering an alert.
Reported SupportedView cited source
[5]
On September 10 Brevo disclosed a different SSO-related incident where attackers hijacked customer accounts and launched phishing attacks targeting customers of companies using Brevo.
Reported SupportedView cited source
[6]
WordPress administrators who visited an affected site while logged in on September 14 should check for unusual plugins installed or activated that day.
Reported SupportedView cited source
[7]
"Because the Worker rewrote responses at the edge and removed security headers such as Content-Security-Policy, our origin servers and files remained unmodified and standard integrity checks did not detect the change," Brevo said.
Reported SupportedView cited source
[8]
Brevo says the key may have been compromised as early as late August, but there is no evidence of prior malicious activity.
Reported SupportedView cited source
[9]
In the hours after detection Brevo revoked the compromised key and credentials created with it, removed the hardcoded credential from its source code, deleted attacker-controlled hostnames and purged its edge caches.
Reported SupportedView cited source
[10]
Visitors to affected websites were shown a fake Cloudflare verification page followed by ClickFix instructions urging them to run a command on Windows.
Reported SupportedView cited source
[11]
On WordPress websites embedding an affected Brevo widget, the script checked whether the visitor was logged in as an administrator and attempted to upload a malicious plugin from https://cdn10.sendibt1[.]com/p/wm.zip.
Reported SupportedView cited source
[12]
Sansec was not able to retrieve the archive; BleepingComputer found it uploaded to VirusTotal and confirms it pretends to be a WordPress plugin named "Web Media Optimizer" but acts as a persistent backdoor and JavaScript loader.
Reported SupportedView cited source
[13]
Once installed, the plugin hides itself from the WordPress plugin list, copies itself into the must-use plugins directory for persistence, and periodically contacts the attacker-controlled https://glegchner.com/ads.php server.
Reported SupportedView cited source
[14]
That URL is currently returning a Base64-encoded URL that decodes to https://corralos[.]beer/a412dkoq.js, which the site injects to fetch a ClickFix lure.
Reported SupportedView cited source
[15]
The plugin stores a backup copy of the last valid JavaScript URL so it can continue loading malicious code if the remote server becomes unavailable.
Reported SupportedView cited source
[16]
The plugin contains a hardcoded authentication key that allows attackers to generate a valid login session for a WordPress administrator account without knowing the account password.
Reported SupportedView cited source
[17]
Cryptocurrency wallet vendor Trezor reported on September 11 that phishing attacks reached 347,000 user email addresses and successfully compromised at least 2,500.
Reported SupportedView cited source
[18]
Brevo did not respond to BleepingComputer's questions as to whether the SSO incident and the Cloudflare compromise were connected.
Reported SupportedView cited source
[19]
Brevo says app.brevo.com, its API, email delivery infrastructure and customer account data were not affected.
Reported SupportedView cited source
[20]
Other domains BleepingComputer saw distributing the malicious WordPress plugin and scripts include https://yelahaye[.]surf and https://boiseno[.]club.
Reported SupportedView cited source
[21]
The at-least-2,500 compromised Trezor users are about 0.7% of the 347,000 addresses the phishing reached.
Derived Supported
[22]
Brevo's remediation of its own key, source code, hostnames and edge caches does not remove an installed copy of the plugin, which persists in the must-use plugins directory and contacts its own command server.
Derived Supported
[23]
On detecting the compromise Brevo removed the Worker and its routes, defining the exposure window as between 16:07 and 20:30 UTC.
Reported ContestedView cited source
[24]
The incident was first reported by security firm Sansec, which said it may have impacted up to 100,000 websites that use the affected Brevo components, and confirmed that all malicious subdomains stopped resolving on September 15 and that Brevo files are now clean.
Reported ContestedView cited source
[25]
Sansec says the incident began on September 14, 2026, between 16:05 and 20:13 UTC.
Reported ContestedView cited source
[26]
Brevo's stated exposure window of 16:07 to 20:30 UTC is 4 hours 23 minutes.
Derived Contested
[27]
Sansec's observed window of 16:05 to 20:13 UTC is 4 hours 8 minutes.
Derived Contested
[28]
Brevo's approximate figure of five and a half hours exceeds the window defined by its own timestamps by about 1 hour 7 minutes.
Derived Contested

Sources

3 independent publishers whose own reporting we read for this story.

bleepingcomputer.com
1 article · September 17, 2026
Brevo supply-chain attack injected ClickFix scripts on customer sites
securityaffairs.com
1 article · September 18, 2026
Brevo Supply-Chain Attack Infected Over 100,000 Websites
securityweek.com
1 article · September 18, 2026
Brevo Supply Chain Attack Injects Malware Into 100,000 Websites

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder34%

The root cause everyone agrees on is a credential. A long-lived Cloudflare API key with full account permissions sat in Brevo's application source code. With it, the attacker could create Workers, routes and DNS records across Brevo's zones without setting off an alert. The second half matters just as much for anyone who ships a script other people embed. Brevo's post-mortem, quoted by BleepingComputer and SecurityAffairs, says the Worker "rewrote responses at the edge and removed security headers such as Content-Security-Policy, our origin servers and files remained unmodified and standard integrity checks did not detect the change". Hashing files at the origin was watching a layer the attack never touched. BleepingComputer is the only one of the three that examined the malicious plugin itself: the thing posing as "Web Media Optimizer" copies itself into the must-use plugins directory, keeps a spare copy of its last working script URL, and carries a hardcoded key that issues an administrator session with no password.

Operator48%

Brevo's cleanup does not finish the job on a customer's own site. Sansec, quoted by SecurityWeek, said it plainly: "Brevo is no longer serving malicious code. However, your WordPress site may have been backdoored, and your customers may have fallen for the ClickFix scam." Anyone who was logged into a WordPress admin session while visiting a site carrying a Brevo form, chat widget or SDK loader on 14 September should look for a plugin installed or activated that day, and look on disk, because this one hides from the plugin screen. SecurityAffairs adds the awkward part: the extra script loaded from sendibt1.com, a real Brevo domain used for email tracking, so blocking it breaks open and click tracking for customers still on the service. Machines where someone pasted a "verification" command into a terminal need scanning, and administrator passwords need rotating if anything turns up.

Investor18%

One vendor, two compromises, four days apart, by different routes. SecurityWeek and SecurityAffairs both carry Brevo's figures for the first: a SAML SSO flaw reached 138 customer accounts, six were used to send phishing, contacts were exported from 43. Trezor, one of the 138, said the phishing reached 347,000 of its users' addresses and compromised at least 2,500, roughly 0.7 percent. The 14 September edge injection has no comparable victim count. The number in every headline, up to 100,000 sites, is Sansec's estimate of how many sites embed the affected components. Brevo did not answer BleepingComputer's question about whether the two incidents are connected. If they are, its containment of the first one failed.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence78: 0100
Vendor post-mortem, backed by two independent checks
Brevo published a post-mortem naming the hardcoded key, Sansec found and dated the injection independently, and BleepingComputer retrieved the plugin from VirusTotal and described its behaviour from the sample rather than from someone's summary. The soft spot is the scale. Every site count in our coverage comes from Sansec's estimate of how many sites embed the affected scripts, and Brevo's own timestamps contradict its own duration summary.
Adoption60: 0100
Documented reach, uncertain damage
What the record measures is reach. Sansec's figure counts sites that embed the affected Brevo components; how many visitors saw the fake verification page, or how many WordPress installs actually took the plugin, remains unknown. The one hard victim count belongs to the earlier breach: Trezor's at least 2,500 compromised users out of 347,000 addresses reached. Against that, the plugin is real and analysed, and both Brevo and Sansec agree the serving stopped by 15 September.
Hype gap+20: −100 understated0 aligned+100 overstated
An estimate hardened into a headline
Sansec said the attack may have hit up to 100,000 websites. SecurityWeek's headline says malware was injected into 100,000 websites and SecurityAffairs says over 100,000 were infected, while both bodies say "likely" and "may have". Brevo rounds a four-hour-and-twenty-three-minute window up to roughly five and a half hours and nobody queried it. Pulling the other way, none of the three leads with the point that matters most: an installed copy of the plugin keeps calling its own command server long after the key rotation and the cache purge.
Incentives58: 0100
Both headline numbers come from interested parties
Brevo wrote the only account of the scope, including the assertion that its API, email delivery and customer account data were untouched, and nothing in our coverage tests that independently. The site count belongs to Sansec, the firm that found the attack and published the indicators, and it measures how many sites carry the scripts rather than how many were hit. BleepingComputer's page ends in a pitch for a paid security summit, which sits oddly beneath a story its reporters advanced by pulling the sample off VirusTotal.
Confidence72: 0100
Certain mechanism, uncertain scale
How the attack worked is documented twice over from Brevo's notice and once more from the sample, so the credential failure, the edge rewrite and the backdoor's persistence are on firm ground. How many sites and users were actually harmed is not, and Brevo's silence on whether the two September incidents share an origin leaves the more serious reading of the first breach open.

Topics and entities

Topics

Secrets Management
Web content integrity monitoring
WordPress Security
CDN and edge security
Software supply chain attacks