Brevo Supply Chain Attack Infects Over 100,000 Websites

• •Attackers exploited a compromised Cloudflare API key to inject malware into Brevo's services.
• •Over 100,000 websites were affected, with a focus on WordPress sites where admins were targeted.
• •Brevo's infrastructure was used to serve malicious scripts, leading to significant downstream impacts.

On September 14, 2026, a compromised Brevo Cloudflare API key allowed attackers to deploy a malicious Cloudflare Worker that injected malware into brevo.com and over 100,000 customer websites. The attack utilized social engineering techniques, displaying a fake CAPTCHA page to visitors, prompting them to execute a command that downloaded malware. Additionally, logged-in WordPress administrators were targeted with a malicious plugin intended to create a backdoor. The malware was served through modified JavaScript assets embedded in customer sites, affecting both Brevo's own domains and its clients, including major brands like eBay and Louis Vuitton. Brevo confirmed that its application at app.brevo.com was unaffected, and the malicious activity ceased by 20:30 UTC on the same day. Independent verification confirmed that all affected pages were cleaned shortly after the incident. Brevo had previously disclosed a separate security issue on September 10, indicating prior vulnerabilities in its systems.