Brevo Supply-Chain Attack Injected Malicious Code Into More Than 100,000 Websites
Summary
Attackers exploited Brevo’s SAML SSO handling, then used a compromised Cloudflare API key to inject malicious scripts. Sansec said more than 100,000 websites were likely impacted; Brevo removed the code and revoked the key.
Key points
- An attacker exploited a vulnerability in Brevo’s SAML SSO handling on September 10 and accessed 138 accounts, including one belonging to Trezor.
- Brevo said attackers sent phishing emails from six accounts and exported contacts from 43 accounts.
- After unauthorized access was closed, attackers returned on September 14 using a compromised, long-lived Cloudflare API key to deploy a worker.
- The worker injected scripts into Brevo properties and JavaScript files embedded by customers on their websites.
- The scripts showed selected visitors a fake Cloudflare verification page using the ClickFix technique; on WordPress sites, they also attempted to install a plugin when a visitor was logged in as an administrator.
- Brevo said the worker was active for about five and a half hours, removed it, and revoked the compromised key and credentials. Sansec estimated that more than 100,000 websites were likely impacted.
- Brevo recommends reviewing sites for compromise; administrators should check for unauthorized plugins, and visitors served the fake pages should check their devices for malware.
Article Details
- Victim Organization
- Brevo
- Incident Type
- Supply-chain attack involving unauthorized account access, phishing emails, contact-data export, and malicious script injection into websites.
- Incident Date
- 2026-09-10
- Data Types Exposed
- Contacts exported from 43 accounts
- Affected Records
- 138 Brevo accounts were accessed; contacts were exported from 43 accounts.
- Operational Impact
- A malicious worker injected scripts into Brevo and sibforms.com and into three JavaScript files embedded by customers. The scripts affected more than 100,000 websites according to Sansec, which described that figure as likely. The worker was active for about five and a half hours, and the scripts displayed fake verification pages and attempted to install a plugin on WordPress sites when visitors were logged in as administrators.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
Vendors
BrevoCustomer engagement platform Brevo fell victim to a supply chain attack that resulted in malicious code being injected into over 100,000 websites.CloudflareThe company closed the unauthorized access, but the attackers returned on September 14, when they used a compromised long-lived Cloudflare API key to deploy a worker.