Brevo ClickFix supply-chain attack: what to check if you embed Brevo

If your personal blog, church site, family business page, or newsletter signup embeds Brevo forms, Conversations, or SDK scripts, take a few minutes and run this checklist. This is not a “panic wipe everything” post. It is a practical look at what happened on September 14, 2026, who was in the blast radius, and what to verify now that Brevo says the edge scripts are clean again.

Brevo published an official post-mortem. BleepingComputer and Sansec covered the customer-site angle, including the roughly 100,000 sites estimate for installs that use the affected Brevo components. Prefer Brevo’s write-up for the timeline and remediation asks. Prefer the security reporting for WordPress plugin details.

What happened (short version)

Attackers got a long-lived Cloudflare API key that Brevo had hardcoded in application source with full account permissions. With that key they deployed a Cloudflare Worker that rewrote responses at the CDN edge for about five and a half hours on September 14. Origin files were not edited. Integrity checks that only look at origin could miss it. The Worker also stripped useful security headers such as Content-Security-Policy while it was active.

Affected surfaces included pages on brevo.com, sendinblue.com, login/account/onboarding Brevo hosts, sibforms.com, plus the embedded forms script, Conversations widget, and SDK loader that customers put on their own sites. Brevo says app.brevo.com, the API, email delivery, and customer account data held in Brevo were not affected.

Brevo’s post-mortem defines a broad impact window of about 15:01 to 20:30 UTC, with the ClickFix content active on the listed URLs from 16:07 to 20:30 UTC. They removed the Worker and routes, revoked the compromised key and credentials created with it, purged caches, and say scripts now serve clean content. Hardening is still ongoing.

Sansec first flagged the incident and estimated up to about 100,000 websites use the affected Brevo components. That is a “sites that load these scripts” ceiling, not a confirmed count of people who saw the lure or machines that got owned. Still: if you embed Brevo, you are in the group that should check.

What visitors may have seen: ClickFix

Selected visitors got a full-screen fake “Cloudflare, verify you are human” page. Some saw it right after a real Cloudflare checkbox. The page told Windows users to press Win+R, then paste, then Enter. That is ClickFix: social engineering that turns your Run dialog into a malware installer. The page was selective, so many people saw nothing on a casual revisit.

Do not treat any “Cloudflare verify” page that asks you to open Run and paste a command as real. Cloudflare does not ask home users to Win+R paste Enter to prove they are human. If you already did that on September 14 after visiting a Brevo page or a site with Brevo embeds, treat the PC as compromised: disconnect it from the network if you can, run a full antivirus / antimalware scan, and change passwords used on that machine, starting with Brevo if you use it.

I am not reproducing the pasted command or the plugin payload here. You do not need those details to protect yourself.

WordPress admins: the quiet plugin path

On WordPress sites that embedded an affected Brevo widget, the injected script also checked whether the visitor was logged in as a WordPress administrator. If so, it tried to silently install and activate a malicious plugin. BleepingComputer analyzed a sample that pretended to be something like “Web Media Optimizer”: a persistent backdoor / JavaScript loader that can hide from the normal plugin list, stick around in must-use plugins, and keep loading remote junk for visitors.

Brevo’s own ask matches what you should do:

If your WordPress site loads Brevo scripts and an administrator visited the site on September 14 while logged in, check for any plugin installed or activated that day, remove anything you did not intentionally add, and change administrator passwords.
Look past the visible Plugins screen. Check must-use plugins (mu-plugins) and anything that appeared without your click.
If you find a stranger plugin from that day, assume the site needs a real cleanup, not just a delete-and-hope. Rotate admin passwords, review other admin users, and restore from a clean backup if you have one from before September 14.

If you also still need the September WordPress core security build, see our WordPress 7.1.1 maintenance and security release note. Different problem, same habit: confirm what is actually running on the site.

Brevo account holders

If you logged into Brevo via brevo.com on September 14, Brevo asks you to change your password and review your API keys as a precaution. Logging in only through app.brevo.com is the path Brevo says was not in the injected surface, but password hygiene after a vendor incident is still cheap insurance. Review API keys you have issued for forms, automations, or plugins and revoke anything you do not recognize.

Brevo says the Conversations widget, SDK, and forms are safe to keep using now that edge content is verified clean. Your job is the local leftovers: PCs that ran the ClickFix steps, and WordPress installs that may have accepted a plugin during that window.

Do this / don’t do that

Inventory whether your site embeds Brevo forms, Conversations, or SDK scripts (including old Sendinblue-era embeds).
On WordPress: if an admin browsed the site while logged in on September 14, audit plugins (including must-use) from that day and rotate admin passwords.
If you ran a Win+R paste command from a fake Cloudflare page, treat that Windows PC as compromised and change passwords used there.
If you used brevo.com login that day, change the Brevo password and review API keys.
Keep WordPress core, themes, and plugins current so you are not stacking unrelated holes on top of this incident.

Don’t

Do not paste Win+R / Run commands from any “verify you are human” page, Cloudflare-branded or not.
Do not assume “Brevo cleaned their CDN” automatically cleaned a backdoored WordPress install.
Do not ignore must-use plugins because the regular Plugins list looks empty.
Do not dig for malware samples or try to reproduce the Worker injection. Cleanup and password rotation beat curiosity here.

Bottom line

For about 5.5 hours on September 14, 2026, a stolen Cloudflare API key let attackers rewrite Brevo CDN responses and inject ClickFix lures (and, on WordPress with a logged-in admin, a malicious plugin install attempt) into Brevo sites and embedded scripts. Brevo says app.brevo.com, API, email, and account data were not hit, and the scripts are clean again. Your checklist is local: never trust Win+R paste lures, check WordPress plugins and admin passwords if you were logged in that day, and rotate Brevo credentials if you used brevo.com login. That is the whole job.

Image: Brevo.com homepage marketing hero.