Brevo Hit by Supply Chain Attack Affecting 100,000 Sites

Brevo, the customer engagement platform formerly known as Sendinblue, served malicious code from its own infrastructure on September 14. The supply chain attack against Brevo ran for about five and a half hours before the company cut it off. It reached far past brevo.com, because the altered files included three scripts that customers embed in their own sites. Researchers put the number of affected websites above 100,000.

Attackers got in with a long-lived Cloudflare API key. They used it to create a Worker, a small program that rewrites web responses at the network edge before a browser receives them. One piece of code therefore changed what every visitor to an affected page saw.

Inside the Supply Chain Attack on Brevo

The trouble started four days earlier. On September 10, an attacker exploited a flaw in how Brevo handled SAML single sign-on and reached 138 customer accounts. The intruder sent phishing emails from six of them and exported contact lists from 43 others. Brevo closed the access route and invalidated active sessions the same day.

The affected customers included Trezor, the cryptocurrency hardware wallet maker. It later reported that around 347,000 of its users received phishing messages. Brevo has not publicly linked that first incident to what followed, though the sequence invites the assumption.

The second intrusion landed on September 14 and turned Brevo into a delivery channel for malware. The stolen key gave attackers control at the CDN edge across brevo.com, sendinblue.com, sibforms.com and several login and onboarding subdomains. They also rewrote the Brevo forms script, the Conversations chat widget and the SDK loader. Those three files carried the supply chain attack onto Brevo customer sites worldwide.

Two Payloads, One Compromised Script

A hidden plugin aimed at WordPress administrators

The injected code checked who was looking. If a logged-in WordPress administrator opened a page on their own site, the script tried to install and activate a plugin in the background. That plugin can hide itself from the admin dashboard, so the installed list may look entirely normal afterwards. Site owners should therefore compare the plugin directory on disk against what the admin screen displays.

A fake verification page for everyone else

Ordinary visitors saw something else. The script threw up a full-page prompt styled as a Cloudflare human verification check. It then told the reader to open the Windows Run dialog and paste a command. That technique goes by the name ClickFix, and it works because the instruction feels procedural rather than suspicious.

The same overlay appeared for people who clicked unsubscribe links in campaign emails sent through the platform. Anyone who followed the instructions ran attacker-supplied code on their own machine. The supply chain attack therefore hit Brevo customers and their visitors at the same time.

Why the Supply Chain Attack on Brevo Reached So Far

Most website compromises force attackers to break into each target separately. Compromising a shared service removes that work, because thousands of unrelated sites already load the same remote file. A marketing form, a chat bubble or a tracking pixel arrives as a script tag pointing at the vendor's servers.

The browser then fetches whatever sits at that address at the moment of the request. Change the file once and every site using it serves the new version. No owner needs to touch a line of code.

Public indexes list more than 114,000 pages referencing Brevo, Sibforms or Sibautomation resources. That scale gave the supply chain attack against Brevo a very large audience. It also explains why a window of a few hours caused such immediate alarm.

What the Numbers Do and Do Not Mean

Loading an affected file is not the same as suffering a compromise. Sites that served the malicious script still needed the right conditions before real damage followed. The plugin path only fired for administrators who were browsing their own site at the time. The ClickFix path required a visitor to copy and run the command.

So the real victim count sits below the headline figure, and nobody can measure it from outside. The supply chain attack on Brevo produced very wide exposure and a much narrower set of confirmed compromises. Site owners have to check their own logs to know where they stand.

Even the exposure window comes in two versions. Brevo defines it as 16:07 to 20:30 UTC on September 14, covering the full life of the malicious Worker. Researchers watched malicious content go out between 16:05 and 20:13 UTC, a little over four hours.

A Long-Lived API Key at the Root

Brevo's investigation found that attackers first misused the Cloudflare key in late August. That put them inside weeks before the supply chain attack became visible to anyone outside Brevo. No malicious content reached customer-facing pages during that earlier period, but the access already existed.

During remediation the company also removed a hardcoded credential from its source code. That detail points to how the key escaped in the first place. Brevo has not formally declared a root cause.

Long-lived keys create exactly this kind of exposure. They sit in configuration files and repositories for months, carry broad permissions, and escape the access reviews that cover human accounts. A key with edge-rewriting rights amounts to a key to every page a company serves.

What Site Owners Should Check Now

Anyone running the Brevo tracker, the chat widget or a hosted form served an affected file on September 14. Start with the plugin list and the directory on disk, looking for anything installed or activated that day. Then search access logs for a POST to /wp-admin/update.php?action=upload-plugin, followed shortly after by a GET to /wp-admin/plugins.php?action=activate.

Administrators who browsed their own site while logged in should treat that session as suspect. Rotating passwords and forcing a logout of all sessions costs very little. A site showing an unfamiliar plugin needs a full review rather than a quick deletion. Backdoors rarely travel alone.

Visitors deserve attention too. Customers who saw a verification prompt and followed it should run a malware scan. They should also change any passwords entered on that machine since September 14. Brevo has confirmed that its files are clean and that the attacker subdomains stopped resolving on September 15.

The Standing Risk in Third-Party Scripts

Every embedded script is a permanent invitation for someone else's code to run in your visitors' browsers. The supply chain attack on Brevo turned that arrangement against more than 100,000 sites in one afternoon, and none of those owners had any say in it. Tighter content security policies and regular review of what a page actually loads reduce the damage, but few marketing scripts support integrity hashes. So the practical defence comes down to knowing which third parties your pages call.

Brevo moved fast once it spotted the Worker, and its own files came back clean within hours. Cleanup on affected customer sites belongs to their owners, though, and much of it has not happened yet. The supply chain attack ended on September 14, but for thousands of Brevo customers the work is only starting.