The recent Brevo security incident is much larger than reported. Sansec found that attackers piggy-backed on embedded Brevo widgets to install Wordpress malware on Brevo customer sites and launch Clickfix attacks against their visitors.
Brevo (aka Sendinblue) lists eBay, Louis Vuitton, Michelin and Amnesty International as its clients. It disclosed ( copy ) a security incident on 10 September, claiming that 6 customer accounts were hijacked. But four days later, a much larger breach hit all of their customers.
On 14 September, Brevo served malware to visitors of its own site and more than 100 thousand customer sites. The malware had two components:
a malicious Wordpress plugin, installed when site admins visited their own site
Then there are two JavaScript assets that merchants embed on their own sites (a tracker and a chat widget):
Verified copies: sdk-loader.js pointing at cdn2 ( 16:10:27 , 19:56:00 ) and at cdn11 ( 18:23:11 ), and brevo-conversations.js pointing at cdn4 ( 17:27:25 ). They got an extra line that loaded the actual malware:
These loader domains vary:
An SSL certificate for cdn.sendibt1.com was created on August 25th. Because sendibt1.com is owned and operated by Brevo, this shows that the attacker had write access to Brevo's DNS records.
Brevo served the malware between 16:05:18 and 20:12:53 UTC on 14 September. Sansec's CSP monitor recorded 2,549 violation reports across 12 sites in and after that window.
Everything is clean at origin now and every malicious host stopped resolving on 15 September. Brevo has not released further communication.
See the source and our deobfuscated copy of the f.js malware.
Is the site visitor logged in on Wordpress? Then secretly install a Wordpress plugin from . We didn't recover this plugin, but it's likely a backdoor.
Otherwise show the visitor a clickfix overlay (urging the person to prove that they're human by copy-pasting a command)
The malware does not activate for crawlers, developers and automated scanners.
There are a couple of hints that suggest that the attackers breached Brevo's Cloudflare account:
The modified assets at cdn.brevo.com have been serving the same Last-Modified dates, before, during and after the incident.
The modified assets at cdn.brevo.com have been serving the same Last-Modified dates, before, during and after the incident.
The five Brevo apex domains all use Cloudflare DNS: brevo.com , sibforms.com , sibautomation.com , sendinblue.com and sendibt1.com . This suggests a single Cloudflare account holding all of them, sendibt1.com included. That is the zone where the attacker created the cdn* records. One account compromise would grant both the DNS writes and the ability to rewrite responses across those zones.
The five Brevo apex domains all use Cloudflare DNS: brevo.com , sibforms.com , sibautomation.com , sendinblue.com and sendibt1.com . This suggests a single Cloudflare account holding all of them, sendibt1.com included. That is the zone where the attacker created the cdn* records. One account compromise would grant both the DNS writes and the ability to rewrite responses across those zones.
sendibt1.com itself is not proxied, answering on Brevo's own 172.246.243.65 in AS200484 with server: envoy , while only the attacker's cdn* records were placed behind the proxy.
sendibt1.com itself is not proxied, answering on Brevo's own 172.246.243.65 in AS200484 with server: envoy , while only the attacker's cdn* records were placed behind the proxy.
Cloudflare Workers or a Snippet support transforming content dynamically .
What Brevo customers should do
Brevo is no longer serving malicious code. However, your Wordpress site may have been backdoored and your customers may have fallen for the Clickfix scam.
your access log for a POST to /wp-admin/update.php?action=upload-plugin that day, and for a GET to /wp-admin/plugins.php?action=activate shortly after. Check for any plugin whose install or activation date is 14 September. Compare the plugin directory on disk against what the admin screen lists, because a plugin can hide itself from that screen.
If you run the Brevo tracker, the chat widget or a hosted Brevo form, your site was serving an affected file between 16:05 and 20:13 UTC on 14 September. Anyone who saw a full-page "verify you are human" prompt on a site and followed its instructions ran a malicious command on their own machine. These people should urgently run an anti-virus scan.
Indicators of compromise
Thanks to ParadoxLabs for escalating the Sansec alert to us.
OptinMonster supply chain attack hits 1.2 million sites
Magento Developers Impersonated in Targeted GitHub Malware Operation
Polyfill supply chain attack hits 100K+ sites
Magento vendor Fishpig hacked, backdoors added
Composer vulnerability leaks GitHub tokens, threatens PHP supply chain
Block all known Magento attacks, while you schedule the latest critical patch until a convenient moment. No more downtime and instability from rushed patching.
Scan your store now for malware & vulnerabilities
eComscan is the most thorough security scanner for Magento, Adobe Commerce, Shopware, WooCommerce, Sylius and many more.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
