Stolen Cloudflare Key Used to Inject ClickFix Scripts on Brevo and Customer Sites
Summary
Brevo says attackers used a stolen Cloudflare API key to inject ClickFix lures and distribute a malicious WordPress plugin through affected sites for about five and a half hours. The company says its core app, API, email delivery and customer data were unaffected.
Key points
- Attackers used a hardcoded, long-lived Cloudflare API key with full account permissions to create a malicious Worker that altered content at the CDN edge for about five and a half hours on September 14.
- Injected scripts affected Brevo pages and embedded forms, widget and SDK code on customer websites, displaying a fake Cloudflare verification page with ClickFix instructions.
- On affected WordPress sites, the script checked for logged-in administrators and attempted to install a plugin posing as “Web Media Optimizer.”
- The plugin hid itself, copied itself into the must-use plugins directory, loaded attacker-controlled JavaScript and contained a hardcoded key that could generate a WordPress administrator session.
- Brevo revoked the compromised key and related credentials, removed the Worker and attacker-controlled hostnames, purged edge caches and removed the hardcoded credential from its source code.
- Brevo says its core app, API, email delivery infrastructure and customer account data were unaffected. Sansec reported that affected components may have reached up to 100,000 websites.
- Administrators who visited affected sites while logged in on September 14 should check for unusual plugins installed or activated that day, remove them if found and rotate administrator passwords.
Article Details
- Victim Organization
- Brevo
- Victim Domain
- brevo.com
- Incident Type
- Cloudflare API key compromise and supply-chain attack used to inject ClickFix scripts and distribute a malicious WordPress plugin
- Incident Date
- 2026-09-14
- Operational Impact
- A malicious Cloudflare Worker modified Brevo content at the CDN edge for approximately five and a half hours. Affected Brevo pages and embedded scripts exposed visitors to ClickFix lures; some WordPress sites were also targeted with a backdoor plugin. Brevo said its core app, API, email delivery systems, and customer account data were not affected. Sansec estimated that up to 100,000 websites using affected components may have been impacted.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//boiseno[.]club | Domain reported by BleepingComputer as distributing the malicious WordPress plugin and scripts. |
| URL | hxxps[:]//cdn10[.]sendibt1[.]com/p/wm.zip | Malicious WordPress plugin archive distributed to affected sites. |
| URL | hxxps[:]//corralos[.]beer/a412dkoq.js | Malicious JavaScript URL injected by the plugin to fetch and display a ClickFix lure. |
| URL | hxxps[:]//glegchner[.]com/ads.php | Attacker-controlled server contacted periodically by the malicious plugin to retrieve JavaScript. |
| URL | hxxps[:]//yelahaye[.]surf | Domain reported by BleepingComputer as distributing the malicious WordPress plugin and scripts. |
Vendors
BrevoBrevo confirmed that attackers stole a Cloudflare API key and used a malicious Cloudflare Worker to inject ClickFix scripts into Brevo pages and customer-embedded JavaScript for several hours on September 14.CloudflareBrevo confirmed that attackers stole a Cloudflare API key and used a malicious Cloudflare Worker to inject ClickFix scripts into Brevo pages and customer-embedded JavaScript for several hours on September 14.
Products
Cloudflare Workerspermissions that had been hardcoded in application source code, which allowed them to create Cloudflare Workers, routes, and DNS records across Brevo’s zones without triggering an alert.WordPressThe compromise also pushed a fake WordPress plugin called “Web Media Optimizer” to some sites, while Brevo says its core app, API, email delivery systems, and customer account data were not affected.
Industries
CryptocurrencyOne high-profile victim was cryptocurrency wallet vendor Trezor, which reported on September 11 that phishing attacks reached 347,000 user email addresses and successfully compromised at least 2,500.Customer relationship management and digital marketingThe customer relationship management and digital marketing company says the attackers used the API key to create a malicious Cloudflare Worker that modified content at the CDN edge for approximately five and a half