On September 10, 2026, attackers exploited a vulnerability in Brevo's SAML SSO implementation to access 138 accounts, including high-profile ones. After closing this initial breach, attackers returned on September 14 using a compromised long-lived Cloudflare API key to deploy a Cloudflare worker that injected malicious scripts into Brevo's domains and three JavaScript files used by customers. The injected script presented a fake 'Cloudflare, verify you are human' page to selected visitors, employing a social engineering technique called ClickFix to convince users to run commands on their computers. On WordPress sites embedding Brevo widgets, the script attempted to install a plugin if the visitor was an administrator, potentially backdooring those sites. The malicious activity lasted roughly five and a half hours before Brevo removed the worker and revoked the API key. Cybersecurity firm Sansec estimates over 100,000 websites were impacted. Brevo confirmed no malicious content was injected before September 14 and has ceased serving malicious code. The attack demonstrates the impact of compromised API keys and supply chain attacks on widely used web services.

The attack resulted in malicious scripts being injected into Brevo's own websites and into JavaScript files embedded by over 100,000 customer websites, potentially exposing visitors to social engineering attacks that could lead to malware infection. WordPress sites using Brevo widgets may have been backdoored via unauthorized plugin installations if administrators visited the malicious pages. The attackers also accessed and exported contacts from 43 accounts and sent phishing emails from six compromised accounts. The incident could lead to widespread compromise of visitor machines and customer websites, undermining trust in affected sites and potentially causing further malware infections.

Brevo has removed the malicious Cloudflare worker and revoked the compromised API key and credentials, stopping the injection of malicious code. Customers using Brevo services should review their websites for unauthorized plugin installations or backdoors, especially WordPress sites embedding Brevo widgets. Visitors who encountered the fake verification page should check their machines for malware. Brevo recommends reviewing all sites using their services for potential compromise. Since the malicious activity has ceased and the compromised credentials revoked, no further immediate action is required to stop ongoing injection.