Brevo Supply-Chain Attack Served Malware to More Than 100,000 Websites

What happened in the Brevo supply-chain attack?

The Brevo supply-chain attack delivered malicious JavaScript through Brevo-hosted website components on September 14, 2026. Sansec found that the malicious code began serving at 16:05:18 UTC and stopped at 20:12:53 UTC, leaving a malware-delivery window of just over four hours. The affected components included Brevo’s embedded tracker, chat widget, hosted signup pages, and unsubscribe pages.

The incident matters because a supply-chain compromise can affect visitors who never held a Brevo account or directly interacted with Brevo’s email platform. A website can load third-party scripts for analytics, forms, chat, or mailing-list management, and a compromise of that external component can place harmful code in a trusted website session. Sansec’s forensic analysis of the Brevo supply-chain attack said the exposure reached more than 100,000 customer sites.

Brevo’s affected customers should not assume that a clean script today proves that no visitor or administrator encountered the payload during the active period. The malicious infrastructure later stopped resolving, and Brevo’s origin was clean when Sansec checked it, but previously affected WordPress sites may already have been altered. The practical response is to treat September 14 website activity as an incident that requires review, not merely a temporary service outage.

How did the malware affect WordPress administrators and visitors?

The malicious Brevo code used 2 different paths based on who visited an affected website. The first path looked for a logged-in WordPress administrator and attempted to install a WordPress plugin from cdn10.sendibt1.com. The second path showed other visitors a ClickFix-style “verify you are human” overlay intended to persuade them to copy and run a malicious command.

The WordPress administrator path created the higher risk for site operators because an installed plugin can provide persistent access after the original third-party script is removed. The visitor path relied on social engineering rather than a silent browser exploit. A deceptive verification screen can appear credible when it is displayed on a familiar website, particularly if the visitor expects a CAPTCHA or anti-bot prompt.

Website visitors who saw a verification prompt should not follow instructions that require opening Terminal, Command Prompt, PowerShell, macOS Terminal, or the Windows Run dialog. Legitimate human-verification systems do not normally require a visitor to copy and execute a command. Users who did run a command should disconnect the affected device from sensitive accounts where practical and contact an employer’s security team or a qualified security professional before attempting broad cleanup.

How many websites were exposed to the Brevo malware?

More than 100,000 customer websites were exposed through Brevo-hosted components, according to Sansec. The estimate covers sites that used the company’s embedded tracker, chat widget, hosted signup pages, or unsubscribe pages. It does not establish that every site had a compromised WordPress administrator or that every visitor executed the ClickFix instructions.

The distinction matters because website exposure, visitor exposure, and confirmed compromise are different measures. A site that loaded a malicious script was exposed during the active window. A visitor who viewed the script was potentially exposed to the overlay. A WordPress site where the attempted plugin installation succeeded requires a separate investigation to determine whether a backdoor or unauthorized changes remain.

Organizations should identify whether their websites loaded Brevo services during the affected period before making public or customer-facing claims about impact. A website security review can also include third-party scripts that were added for marketing, analytics, customer support, and subscription forms. Businesses that have not recently reviewed their external code dependencies may find a structured website audit process useful for documenting which services load in customer browsers.

How was the Brevo malware incident connected to the earlier account breach?

The malware-delivery incident followed an earlier Brevo SAML single sign-on intrusion, but the incidents involved different reported access paths. Brevo said an attacker exploited a SAML SSO scoping flaw to access 138 customer accounts on September 10, 2026. The attacker used 6 accounts to send phishing emails and exported contacts from 43 accounts.

Brevo said it closed the exploited route and reset all active user sessions at 8:30 a.m. UTC. The earlier incident is important context because phishing emails sent through a legitimate marketing platform can appear more trustworthy to recipients. Trezor later said that a Brevo breach led to phishing emails sent to 347,000 wallet users, illustrating why recipients should verify unexpected account messages through a company’s official site rather than email links.

The later Brevo supply-chain compromise was tied to a compromised long-lived Cloudflare API key, following the earlier SSO incident, according to independent reporting on the Brevo malware injection. The available reporting does not establish that every affected website customer had an account accessed through the SSO flaw. The most sensible interpretation is that Brevo customers and their visitors faced separate risks: phishing from the account intrusion and malware exposure from compromised hosted web assets.

What should Brevo customers do after the supply-chain attack?

Brevo customers should review websites that used Brevo-hosted scripts on September 14 and investigate any WordPress administrator activity during the malicious window. The most urgent checks are unauthorized plugins, unfamiliar administrator accounts, modified site files, unusual server activity, and requests connected to cdn10.sendibt1.com. A clean current Brevo script does not rule out changes that occurred while malicious code was active.

1. Identify every website, landing page, signup page, and unsubscribe page that loaded a Brevo tracker, widget, or hosted form.
2. Review WordPress plugin lists, administrator accounts, file modifications, and available access logs for activity on September 14.
3. Remove and preserve evidence of any unauthorized plugin or account before making extensive changes, if your incident-response process requires evidence retention.
4. Rotate credentials and API keys that could have been exposed through affected administrative sessions.
5. Contact Brevo support and a qualified incident-response provider if you find unauthorized changes or cannot determine whether a plugin installation succeeded.

Brevo customers should also notify their internal web teams, agencies, and hosting providers because responsibility for a WordPress installation is often split across several organizations. Businesses that recently handled a separate customer-data incident may recognize the value of prompt, accurate notification from coverage of the Gyazo data breach. The appropriate notice depends on what the investigation confirms, not simply on whether the site used Brevo.

What should visitors do if they saw the fake verification screen?

Visitors should close the website and avoid copying or running any command presented by a “verify you are human” prompt. The observed ClickFix-style screen was designed to turn a normal-looking verification request into user-executed malware. The scam relies on the visitor performing the harmful action, which means stopping before the command is run prevents that specific installation attempt.

Visitors who closed the overlay without running a command should avoid revisiting the page until the site confirms that it resolved the issue. Visitors who copied or ran a command should change passwords from a separate trusted device if they entered credentials afterward, monitor important accounts, and seek professional support for a work-managed computer. An employer’s IT or security team should handle a business device because an individual user may not be able to determine what the command changed.

Consumers should remain cautious with security prompts even when they appear on otherwise familiar websites. Browser and operating-system protections can help identify known threats, but they do not replace careful judgment when a webpage asks for direct command execution. Google’s recent scam-warning tools reflect a broader effort to flag suspicious content, although a warning feature cannot guarantee that every deceptive page will be identified.

What does the Brevo supply-chain attack mean for website security?

The Brevo supply-chain attack shows that third-party website scripts can extend a company’s security risk to visitors, administrators, and downstream customer systems. Marketing and customer-support tools often operate inside a website visitor’s browser, which gives them broad reach when a trusted provider’s hosted asset is compromised. The attack did not require every affected website owner to make a new code change during the four-hour malicious period.

Third-party services remain useful, but website owners should maintain an inventory of embedded scripts and know which pages load each one. The inventory should include analytics tags, chat widgets, payment components, hosted forms, consent tools, and email signup scripts. A documented list helps an organization disable a provider component quickly and determine which pages and users require investigation after a vendor incident.

Brevo said it had closed the exploited SSO route and reset active sessions after the September 10 account intrusion. The Brevo incident write-up provides the company’s account-level figures and response actions. Website owners should continue to monitor Brevo communications, but they should also independently inspect their own sites because the reported risk includes possible WordPress backdoors that a vendor-side cleanup cannot remove.

FAQ

Was Brevo itself hacked?

Yes, Brevo disclosed an earlier SAML SSO scoping flaw that gave an attacker access to 138 customer accounts. The later malware-delivery incident was reportedly tied to a compromised long-lived Cloudflare API key and affected Brevo-hosted website components.

Did the Brevo supply-chain attack affect every Brevo customer?

No, the available findings say more than 100,000 customer websites were exposed through specific Brevo-hosted components, not that every Brevo customer was affected. Website owners should check whether their sites used the embedded tracker, chat widget, hosted signup pages, or unsubscribe pages.

What was the malicious WordPress plugin domain?

The malicious code attempted to install a WordPress plugin from cdn10.sendibt1.com when it detected a logged-in WordPress administrator. Website owners should investigate that domain in available logs and seek incident-response help if unauthorized changes appear.

Should visitors run a command to pass a website verification check?

No, visitors should not run a command to complete a website verification check. The Brevo incident used a ClickFix-style overlay that attempted to persuade visitors to copy and execute a malicious command.

Is the Brevo malware threat over?

The malicious hosts stopped resolving and Brevo’s origin was clean when Sansec checked, but affected WordPress sites may already have been backdoored. Website owners should complete an investigation before concluding that their individual sites are safe.