{"id":"brevo-poisoned-scripts-clickfix-sep-2026","category":"supply-chain","status":"closed","title":"Brevo website scripts poisoned with ClickFix prompts and a WordPress backdoor","tldr":"Poisoned Brevo scripts exposed website visitors to fake verification prompts and attempted WordPress backdoor installation. Brevo stopped the injection; anyone who ran a prompted command, and affected site owners, still need to check for compromise.","summary":"On 14 September, attackers used a stolen Cloudflare API key to alter Brevo pages and scripts delivered to customer websites. Fake verification prompts persuaded selected Windows visitors to run malware; logged-in WordPress administrators could also trigger a malicious plugin installation. Sansec estimated exposure across more than 100,000 sites, not confirmed infections. Brevo gives an overall impact window of 15:01–20:30 UTC, with customer-embedded scripts affected from 16:07. It says its application, API, email sending and stored customer account data were unaffected. As at 3 November, Brevo marks the incident resolved, with security improvements ongoing. That does not establish that previously infected computers or WordPress sites have been cleaned. The reviewed sources give no confirmed infection total.","action":"Never run a command to pass a website verification check; if you did, disconnect that computer, run a full antivirus scan and change passwords used on it. Ask your website manager to check affected WordPress sites for unauthorised plugins, including hidden ones, and change administrator passwords. If you signed in through brevo.com on 14 September, change your Brevo password and review your API keys.","product":"Brevo websites, Forms, Conversations widget and SDK loader","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["brevo","supply-chain","clickfix","wordpress","malware"],"affected":["Brevo public pages, including brevo.com, sendinblue.com and sibforms.com","Brevo Forms script, Conversations widget and SDK loader delivered on 14 September 2026"],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Security Incident - ClickFix: post-mortem","url":"https://status.brevo.com/incidents/01M2QBC4EZ24ZACW6SWQYVW8N3/write-up","by":"Brevo","date":"2026-09-17"},{"kind":"advisory","title":"Security Incident - ClickFix","url":"https://status.brevo.com/incidents/01M2QBC4EZ24ZACW6SWQYVW8N3","by":"Brevo","date":"2026-09-14"},{"kind":"research","title":"Brevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malware","url":"https://sansec.io/research/brevo-supply-chain-attack","by":"Sansec","date":"2026-09-16"},{"kind":"news","title":"Brevo supply-chain attack injected ClickFix scripts on customer sites","url":"https://www.bleepingcomputer.com/news/security/brevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites/","by":"BleepingComputer","date":"2026-09-17"}],"started":"2026-09-14","closed":"2026-09-17","created":"2026-11-03T21:31:42.930Z","updated":"2026-11-03T21:31:42.930Z","cve_notes":[],"timeline":[{"at":"2026-09-17","added":"2026-11-03T21:25:43.261Z","kind":"vendor-revised","text":"Brevo published its post-mortem. BleepingComputer separately identified the attempted WordPress installation as a persistent backdoor disguised as a plugin called Web Media Optimizer.","url":"https://www.bleepingcomputer.com/news/security/brevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites/","by":"BleepingComputer","patch":null},{"at":"2026-09-16","added":"2026-11-03T21:25:43.261Z","kind":"disclosed","text":"Sansec published its investigation, estimating exposure across more than 100,000 customer websites. Its observed malicious-script window was 16:05–20:13 UTC on 14 September, differing slightly from Brevo's later account.","url":"https://sansec.io/research/brevo-supply-chain-attack","by":"Sansec","patch":null},{"at":"2026-09-15T17:45Z","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"Sansec recorded its last security-policy report from a cached copy. It also reported that all malicious Brevo hostnames stopped resolving that day.","url":"https://sansec.io/research/brevo-supply-chain-attack","by":"Sansec","patch":null},{"at":"2026-09-15","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"Brevo began notifying customers.","url":"https://status.brevo.com/incidents/01M2QBC4EZ24ZACW6SWQYVW8N3/write-up","by":"Brevo","patch":null},{"at":"2026-09-14T20:42Z","added":"2026-11-03T21:25:43.261Z","kind":"all-clear","text":"Independent checks confirmed that the affected pages and scripts were clean, according to Brevo.","url":"https://status.brevo.com/incidents/01M2QBC4EZ24ZACW6SWQYVW8N3/write-up","by":"Brevo","patch":null},{"at":"2026-09-14T20:30Z","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"Brevo removed the malicious Cloudflare Worker and its routes and revoked the compromised credentials, stopping the injection.","url":"https://status.brevo.com/incidents/01M2QBC4EZ24ZACW6SWQYVW8N3/write-up","by":"Brevo","patch":"na"},{"at":"2026-09-14T16:07Z","added":"2026-11-03T21:25:43.261Z","kind":"wider-attacks","text":"Brevo says the attacker extended the injection to three customer-embedded scripts and sibforms.com.","url":"https://status.brevo.com/incidents/01M2QBC4EZ24ZACW6SWQYVW8N3/write-up","by":"Brevo","patch":null},{"at":"2026-09-14T15:01Z","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"Brevo dates the start of customer-facing impact to 15:01 UTC. Its investigation found earlier misuse of the stolen key in late August, but no earlier customer-facing injection.","url":"https://status.brevo.com/incidents/01M2QBC4EZ24ZACW6SWQYVW8N3/write-up","by":"Brevo","patch":null}],"url":"https://hard.fyi/live/brevo-poisoned-scripts-clickfix-sep-2026/","json":"https://hard.fyi/api/live?id=brevo-poisoned-scripts-clickfix-sep-2026"}