On September 14, 2026, attackers conducted a supply chain attack against Brevo by compromising its infrastructure and injecting malicious code into JavaScript assets and widgets served to over 100,000 customer websites. The attack involved modification of CDN-hosted files and creation of malicious subdomains under sendibt1.com, with evidence indicating attackers accessed Brevo's Cloudflare account to alter DNS records and dynamically rewrite content. Two payloads were delivered: a WordPress plugin backdoor that installed automatically when site administrators visited their sites while logged in, and ClickFix overlays targeting regular visitors. The attack window was approximately four hours. Brevo's clientele includes major organizations such as eBay, Louis Vuitton, Michelin, and Amnesty International, amplifying the attack's potential reach and impact.

The attack compromised the integrity of Brevo's JavaScript assets and widgets, resulting in the automatic installation of a WordPress backdoor on over 100,000 customer websites. This backdoor could allow persistent unauthorized access to affected WordPress sites. Additionally, ClickFix overlays targeted regular visitors, potentially enabling further malicious activity such as data theft or manipulation. The compromise of Brevo's Cloudflare account allowed attackers to modify DNS records and rewrite content dynamically, increasing the attack's stealth and effectiveness. The involvement of high-profile clients suggests a significant potential impact on a broad and diverse set of organizations.

No official patch or remediation guidance is provided in the available data. Since this is a supply chain attack involving Brevo's infrastructure and CDN assets, remediation requires Brevo to secure its infrastructure, revoke unauthorized access to its Cloudflare account, and restore clean JavaScript assets and widgets. Affected site administrators should audit their WordPress installations for unauthorized plugins or backdoors and remove any malicious components. Monitoring for unusual DNS changes and network traffic related to the malicious subdomains (sendibt1.com and its variants) is recommended. Patch status is not yet confirmed — check Brevo's official advisory for current remediation guidance.