Customer relationship management and digital marketing firm **Brevo** has disclosed a supply chain attack stemming from a compromised **Cloudflare** API key. Attackers exploited this key to deploy a malicious **Cloudflare Worker**, which then modified content at the CDN edge for approximately five and a half hours on September 14th. The incident impacted pages across brevo.com, sendinblue.com, login/account/my/onboarding.brevo.com, and sibforms.com. Crucially, the **Cloudflare Worker** also altered **Brevo**'s forms script, **Brevo Conversations** widget, and the **Brevo SDK** loader scripts that customers integrate into their own websites. ## The Root Cause: Hardcoded Credentials In a post-mortem report, **Brevo** revealed that attackers obtained a long-lived **Cloudflare** API key with full account permissions. This key was unfortunately hardcoded within application source code, enabling the creation of **Cloudflare Workers**, routes, and DNS records across **Brevo**'s zones without triggering any alerts. "Because the Worker rewrote responses at the edge and removed security headers such as Content-Security-Policy, our origin servers and files remained unmodified and standard integrity checks did not detect the change," **Brevo** explained. While the key may have been compromised as early as late August, there is no evidence of prior malicious activity. ## Incident Response and Remediation Upon detection, **Brevo** swiftly removed the malicious **Worker** and its associated routes, defining the exposure window as between 16:07 and 20:30 UTC. Subsequent actions included revoking the compromised key and any credentials created with it, removing the hardcoded credential from their source code, deleting attacker-controlled hostnames, and purging edge caches. **Brevo** has stated that app.brevo.com, its API, email delivery infrastructure, and customer account data remained unaffected. ## Widespread ClickFix Attacks Security firm **Sansec** was the first to report on the incident, estimating that up to 100,000 websites utilizing affected **Brevo** components may have been impacted. **Sansec** confirmed that the malicious subdomains ceased resolving on September 15th, and **Brevo** files are now clean. Visitors to compromised websites were presented with a deceptive **Cloudflare** verification page, followed by **ClickFix** instructions prompting them to execute a command on Windows systems. For **WordPress** sites embedding an affected **Brevo** widget, the script also checked if the visitor was logged in as an administrator. If so, it attempted to upload a malicious plugin from `https://cdn10.sendibt1[.]com/p/wm.zip`. While **Sansec** could not retrieve the archive, **BleepingComputer** found it on **VirusTotal**, confirming it masquerades as a **WordPress** plugin named "Web Media Optimizer." In reality, it functions as a persistent backdoor and JavaScript loader. Other domains distributing this malicious plugin and scripts included `https://yelahaye[.]surf` and `https://boiseno[.]club`.  *Malicious Web Media Optimizer plugin with auth credential redacted* *Source: BleepingComputer* Once installed, the plugin hides itself from the **WordPress** plugin list, copies itself into the must-use plugins directory for persistence, and periodically contacts the attacker-controlled server `https://glegchner.com/ads.php`. This URL currently returns a Base64-encoded URL pointing to JavaScript, which the plugin then injects into visitors' pages. The decoded URL, `https://corralos[.]beer/a412dkoq.js`, fetches a **ClickFix** lure for display. The plugin also maintains a backup of the last valid JavaScript URL to ensure continued malicious code loading if the remote server becomes unavailable. Furthermore, the plugin contains a hardcoded authentication key, enabling attackers to generate a valid login session for a **WordPress** administrator account without needing the actual password. ## Previous SSO Incident This incident follows another disclosure by **Brevo** on September 10th regarding an **SSO**-related incident. In that event, attackers hijacked customer accounts to launch phishing attacks targeting clients of companies using **Brevo**. A high-profile victim was cryptocurrency wallet vendor **Trezor**, which reported on September 11th that phishing attacks reached 347,000 user email addresses, compromising at least 2,500. **Brevo** has not yet clarified whether the **SSO** incident and the **Cloudflare** compromise are connected. **WordPress** administrators who visited an affected site while logged in on September 14th are strongly advised to check for any unusual plugins installed or activated on that day and remove them. If found, all administrator passwords should also be immediately rotated.