Brevo Supply-Chain Attack: The Edge Worker That Poisoned 100,000 Customer Websites From a Hardcoded API Key

A single hardcoded Cloudflare API key sitting inside Brevo’s own source code let attackers rewrite what thousands of customer websites served to visitors, without touching a single origin server.

The marketing-platform company confirmed on September 17 that attackers used the stolen key to create a malicious Cloudflare Worker and inject ClickFix scripts into brevo.com, sendinblue.com, its login and onboarding subdomains, and sibforms.com. The Worker also modified the three pieces of code that customers embed on their own sites: the Brevo forms script, the Conversations chat widget, and the SDK loader. Security firm Sansec puts the exposure at as many as 100,000 websites.

The window ran from 16:07 to 20:30 UTC on September 14. Five and a half hours. That is all it took for a supply-chain incident that most detection tooling never saw coming, because there was nothing for the tooling to see.

The edge did the damage, so the origin looked clean

This is the detail that should change how you think about file integrity monitoring. The Worker rewrote responses at the CDN edge and stripped security headers like Content-Security-Policy on the way out. Brevo’s origin servers and files were never modified. Standard integrity checks found nothing, because nothing at the origin had changed.

The key itself was hardcoded in application source code and carried full account permissions. Anyone holding it could create Workers, routes, and DNS records across every Brevo zone without triggering an alert. Brevo says the key may have been compromised as far back as late August, with no evidence of malicious use before September 14.

After detecting the compromise, Brevo removed the Worker and its routes, revoked the key and any credentials derived from it, pulled the hardcoded credential out of source, deleted attacker-controlled hostnames, and purged edge caches. All malicious subdomains stopped resolving on September 15.

What visitors actually got served

Depending on the victim site, visitors saw a fake Cloudflare verification page followed by ClickFix instructions, the social-engineering pattern that talks someone into pasting a command into the Windows Run box. On WordPress sites running an affected Brevo widget, the script did something nastier. It checked whether the visitor was logged in as an administrator and, if so, tried to install a plugin called “Web Media Optimizer.”

BleepingComputer confirmed the plugin is a persistent backdoor. Once installed it:

• Hides itself from the WordPress plugin list.
• Copies itself into the must-use plugins directory so it survives deactivation.
• Beacons to attacker infrastructure that hands it a Base64-encoded URL for the next-stage JavaScript.
• Stores a backup of the last valid payload URL so it keeps working when the primary server dies.
• Carries a hardcoded authentication key that lets the attackers open a valid administrator session without knowing any password.

That last bullet is the one I keep turning over. A stolen password is a problem you can fix by rotating credentials. A backdoor that forges admin sessions is a different category of problem. You have to find and delete it, and it was hiding from the exact page where you go looking for plugins.

A bad fortnight for trusting your email vendor

This is Brevo’s second incident in one week. On September 10 the company disclosed an SSO-related compromise in which attackers hijacked customer accounts and phished their users. One victim, hardware wallet vendor Trezor, reported that the phishing reached 347,000 user email addresses and compromised at least 2,500 of them. Brevo did not answer whether the two incidents connect.

If you run a WordPress site that embeds a Brevo form, chat widget, or SDK, the checklist is short. Look for any plugin installed or activated on September 14, especially one called Web Media Optimizer. Remove anything you did not put there, rotate administrator passwords, and audit your user list for admins you do not recognize. Then ask the harder question your vendor probably will not answer for you: what other third-party script is loading on your pages right now, and who holds the keys to the edge that serves it.

What this means for African enterprises

South African banks, retailers, and fintechs embed the same class of vendor scripts on login pages and checkout flows. Chat widgets, form tools, analytics, marketing tags. Every one of them is a trusted code path you do not control, served through DNS and CDN infrastructure that rarely shows up in your asset inventory. The Brevo incident makes the point plainly: the compromise does not need to reach your servers. It only needs to reach the edge in front of them.

eHawu exists for that gap. Our network-layer platform gives African enterprises continuous visibility into the DNS paths and third-party dependencies their traffic actually flows through, so an attacker-created hostname or a silently rewritten response has somewhere to be caught before a customer ever sees it. When your vendor’s edge becomes the attack surface, you had better own the view of yours.