Threat Intel
Brevo Supply‑Chain Breach: Cloudflare Key Theft Fuels ClickFix Malware Injection
Brevo’s hard‑coded Cloudflare API key fell into attackers’ hands, enabling a malicious Cloudflare Worker that ran for over five hours on September 14. The worker injected ClickFix scripts into Brevo’s own sites and the JavaScript libraries customers embed on their pages, distributing a backdoor WordPress plugin and other malware. Affected sites include brevo.com, sendinblue.com, and several customer‑facing URLs. Brevo quickly revoked the key, removed the Worker, and purged edge caches, but up to 100 000 third‑party sites may have been compromised. The incident underscores the risk of embedding
Attack Overview
On September 14, attackers leveraged a stolen Cloudflare API key to spin up a Cloudflare Worker that rewrote content at the CDN edge. For roughly five and a half hours, the worker injected malicious ClickFix scripts into Brevo’s own domains and into the JavaScript files that Brevo customers embed on their websites.
How It Happened
The key was hard‑coded in Brevo’s application source code, giving attackers full account permissions. With that, they created new Workers, routes, and DNS records without triggering any alerts. Because the Worker operated at the edge, it could strip security headers like Content‑Security‑Policy and modify responses on the fly while leaving Brevo’s origin servers untouched.
Affected Assets
- brevo.com
- sendinblue.com
- login/account/my/onboarding.brevo.com
- sibforms.com
- Brevo forms script, Conversations widget, and SDK loader scripts embedded on customer sites
Core services such as app.brevo.com, the API, and the email delivery infrastructure were not compromised.
Malicious Payloads
Visitors to the affected pages were first presented with a counterfeit Cloudflare verification page, then prompted to run a Windows command that downloaded a malicious WordPress plugin named “Web Media Optimizer.” The plugin hides itself from the normal plugin list, copies to the must‑use plugins directory for persistence, and periodically contacts an attacker‑controlled server to receive further instructions.
Response & Mitigation
Brevo detected the breach between 16:07 and 20:30 UTC, immediately removed the Worker and its routes, revoked the compromised API key, and purged all edge caches. The hard‑coded credential was removed from the codebase and the attacker‑created hostnames were deleted. Security firm SanSec reported that up to 100 000 third‑party sites embedding Brevo components were affected, but the malicious subdomains stopped resolving by the next day and Brevo’s files are now clean.
What to Do
Websites that embed Brevo widgets or SDKs should verify that the scripts are unmodified and that no unexpected plugins are present. Review CDN edge configurations for any unauthorized Workers, and audit any hard‑coded credentials in source code. If you suspect compromise, purge local and CDN caches, rotate all API keys, and monitor for unusual outbound traffic.
"Because the Worker rewrote responses at the edge and removed security headers such as Content‑Security‑Policy, our origin servers and files remained unmodified and standard integrity checks did not detect the change," Brevo explained in its post‑mortem.
Related articles
ClickFix Attack: Rapid Detection and Response with Huntress Attack Disruption
A new variant of the ClickFix malware bypasses traditional file‑based defenses by executing in memory. Huntress’s Attack Disruption module stops the payload chain in under a second, preventing credential theft and lateral movement. SecOps teams should enable Attack Disruption, monitor for suspicious process chains, and update endpoint policies accordingly.
Read briefing
CrowdStrike Unveils Falcon Sensor Upgrade to Block Malicious Open‑Source Packages in Real Time
CrowdStrike has rolled out a new layer of protection inside its Falcon endpoint sensor that stops supply‑chain attacks before they hit the device. By using on‑device AI to classify and block malicious open‑source packages at download time, the update closes a key attack vector that has become a staple of modern ransomware and data‑exfiltration campaigns. The change is part of CrowdStrike’s broader push toward zero‑trust browser security and agentic SOC capabilities, giving defenders a faster, more autonomous shield against the ever‑evolving supply‑chain threat landscape.
Read briefing
ClickFix Campaign Compromises Ukrainian Sites, Deploys Psychedelic Stealer via Fake Cloudflare Verification
An active ClickFix campaign has injected fake Cloudflare verification pages into legitimate Ukrainian business sites, tricking visitors into running an MSI installer that delivers the Psychedelic stealer. The malware harvests credentials, cryptocurrency wallet data, and establishes persistence via scheduled tasks. Defenders should block the attacker domains, detect MSI executions, and harden web applications against iframe injection.
Read briefing
Quasar Linux RAT: Rootkit, PAM Backdoor, Credential Harvesting in Supply-Chain Threat
TrendAI uncovered Quasar Linux (QLNX), a stealthy Linux RAT that embeds a kernel rootkit, a PAM backdoor, and credential‑harvesting modules. The malware evades most AV, enabling persistent root access in compromised supply chains. Defenders should audit PAM, scan for rootkits, and enforce strict supply‑chain controls.
Read briefing