NewsCompaniesFlawsGuides
Get the app
HighClosedUpdated

Brevo website scripts poisoned with ClickFix prompts and a WordPress backdoor

Poisoned Brevo scripts exposed website visitors to fake verification prompts and attempted WordPress backdoor installation. Brevo stopped the injection; anyone who ran a prompted command, and affected site owners, still need to check for compromise.

What to do

Never run a command to pass a website verification check; if you did, disconnect that computer, run a full antivirus scan and change passwords used on it. Ask your website manager to check affected WordPress sites for unauthorised plugins, including hidden ones, and change administrator passwords. If you signed in through brevo.com on 14 September, change your Brevo password and review your API keys.

What’s happening

On 14 September, attackers used a stolen Cloudflare API key to alter Brevo pages and scripts delivered to customer websites. Fake verification prompts persuaded selected Windows visitors to run malware; logged-in WordPress administrators could also trigger a malicious plugin installation. Sansec estimated exposure across more than 100,000 sites, not confirmed infections. Brevo gives an overall impact window of 15:01–20:30 UTC, with customer-embedded scripts affected from 16:07. It says its application, API, email sending and stored customer account data were unaffected. As at 3 November, Brevo marks the incident resolved, with security improvements ongoing. That does not establish that previously infected computers or WordPress sites have been cleaned. The reviewed sources give no confirmed infection total.

What
Poisoned software
Affects
Brevo websites, Forms, Conversations widget and SDK loader
Affected
Brevo public pages, including brevo.com, sendinblue.com and sibforms.com
Brevo Forms script, Conversations widget and SDK loader delivered on 14 September 2026
Fixed in
Nothing to patch
Since
14 Sept 2026
Closed
17 Sept 2026

Timeline

  1. Vendor revised

    Brevo published its post-mortem. BleepingComputer separately identified the attempted WordPress installation as a persistent backdoor disguised as a plugin called Web Media Optimizer.

  2. Made public

    Sansec published its investigation, estimating exposure across more than 100,000 customer websites. Its observed malicious-script window was 16:05–20:13 UTC on 14 September, differing slightly from Brevo's later account.

  3. Update

    Sansec recorded its last security-policy report from a cached copy. It also reported that all malicious Brevo hostnames stopped resolving that day.

  4. Update

    Brevo began notifying customers.

  5. All clear

    Independent checks confirmed that the affected pages and scripts were clean, according to Brevo.

  6. UpdateNothing to patch

    Brevo removed the malicious Cloudflare Worker and its routes and revoked the compromised credentials, stopping the injection.

  7. Wider attacks

    Brevo says the attacker extended the injection to three customer-embedded scripts and sibforms.com.

  8. Update

    Brevo dates the start of customer-facing impact to 15:01 UTC. Its investigation found earlier misuse of the stolen key in late August, but no earlier customer-facing injection.

Sources

  1. Security Incident - ClickFix: post-mortemBrevo · 17 Sept 2026
  2. Security Incident - ClickFixBrevo · 14 Sept 2026
  3. Brevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malwareSansec · 16 Sept 2026
  4. Brevo supply-chain attack injected ClickFix scripts on customer sitesBleepingComputer · 17 Sept 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from September 2026 · JSON · RSS