MalwarePublished 18 Sep 2026

Brevo Supply Chain Attack Injects Malware Into 100,000 Websites

Source SecurityWeek

Description

Brevo, a customer engagement platform, suffered a supply chain attack where attackers exploited a vulnerability in SAML SSO to gain access to accounts and later used a compromised Cloudflare API key to deploy malicious scripts. These scripts were injected into Brevo's websites and JavaScript files embedded by over 100,000 customer websites. The malicious code showed a fake Cloudflare verification page to visitors, attempting to trick them into running commands on their machines (ClickFix social engineering). The attack lasted about five and a half hours before Brevo revoked the compromised credentials and removed the malicious worker. The incident highlights risks from compromised API keys and supply chain vulnerabilities.

Impact

The attack resulted in malicious scripts being injected into Brevo's own websites and into JavaScript files embedded by over 100,000 customer websites, potentially exposing visitors to social engineering attacks that could lead to malware infection. WordPress sites using Brevo widgets may have been backdoored via unauthorized plugin installations if administrators visited the malicious pages. The attackers also accessed and exported contacts from 43 accounts and sent phishing emails from six compromised accounts. The incident could lead to widespread compromise of visitor machines and customer websites, undermining trust in affected sites and potentially causing further malware infections.

Defensive guidance

Brevo has removed the malicious Cloudflare worker and revoked the compromised API key and credentials, stopping the injection of malicious code. Customers using Brevo services should review their websites for unauthorized plugin installations or backdoors, especially WordPress sites embedding Brevo widgets. Visitors who encountered the fake verification page should check their machines for malware. Brevo recommends reviewing all sites using their services for potential compromise. Since the malicious activity has ceased and the compromised credentials revoked, no further immediate action is required to stop ongoing injection.

References

securityweek.com/brevo-supply-chain-attack-injects-malware-into-100000-websites/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 18 Sep 2026, 10:01 UTC

References

Community reviews

Related threats