By ByteBot
On September 14, a single hardcoded Cloudflare API key gave attackers CDN-edge control over Brevo’s infrastructure. For five and a half hours, every website embedding a Brevo widget served either a fake “Cloudflare verification” page — or, for logged-in WordPress admins, silently installed a backdoor plugin capable of generating admin sessions without a password. Around 100,000 websites were in the blast radius. Brevo’s origin servers were never touched.
One Key, Full CDN Control
The root cause is as old as it is preventable. Attackers obtained a long-lived Cloudflare API key with full account permissions that had been hardcoded in Brevo’s application source code. All five Brevo apex domains — brevo.com, sibforms.com, sendinblue.com, sibautomation.com, and sendibt1.com — run through Cloudflare DNS. That one key let them create Workers, register subdomains, and route traffic. A malicious SSL certificate for cdn.sendibt1.com was registered on August 25, suggesting the attackers held the key for weeks before pulling the trigger.
The Worker they deployed rewrote CDN edge responses for three JavaScript files Brevo customers embed on their sites: sdk-loader.js, brevo-conversations.js, and the Brevo forms script. It also stripped Content-Security-Policy headers from responses, ensuring browsers couldn’t block the injected code. The origin servers looked clean the entire time.
Two Payloads, Two Targets
The injected script checked who was visiting and acted accordingly.
Regular visitors got a ClickFix overlay: a fake Cloudflare human-verification page instructing them to copy a command and paste it into their terminal. ClickFix is the fastest-growing initial access technique of 2026 precisely because it exploits developer conditioning — technically literate users are accustomed to running curl commands from installation guides. The malware turns that habit against them.
WordPress admins got something worse. If the script detected a logged-in administrator, it silently downloaded and installed a plugin called “Web Media Optimizer” from an attacker-controlled domain. The plugin hid itself from the WordPress plugin list, copied itself into the must-use plugins directory for persistence, and contained a hardcoded authentication mechanism that could generate valid administrator sessions without knowing the real password. It called home to glegchner[.]com. If you ran a WordPress site with a Brevo widget on September 14, check now:
grep -rlE "Web Media Optimizer|glegchner" wp-content/
ls -la wp-content/mu-plugins/ | grep "2026-09-14"The Anti-Detection Detail That Should Concern You
The malware explicitly skipped activation for crawlers, developers, and automated security scanners. It fingerprinted the environment using DOM selectors before deciding to execute. Developers who tested their sites during the attack window saw nothing wrong. Their end users got hit anyway.
This is the defining feature of CDN-layer supply chain attacks: the attack surface isn’t on your servers. You can have immaculate origin security and still distribute malware to hundreds of thousands of browsers because you embedded a third-party script.
2026’s Supply Chain Problem
The Brevo attack is the most visible incident in a pattern that’s defined 2026 security. The keyv npm package was backdoored in August via a compromised maintainer account. The LiteLLM supply chain was poisoned through a compromised Trivy instance, affecting 434,000 CI/CD pipelines. npm, PyPI, and Docker Hub were hit in coordinated attacks targeting developer credentials in April. In every case, the attacker used a stolen or hardcoded legitimate credential to make calls indistinguishable from normal developer activity.
Behavioral anomaly detection doesn’t catch a valid API key making valid API calls. The only defense is to limit what those keys can do and ensure they aren’t sitting in your codebase.
What Developers Should Change Today
The obvious fix is the one Brevo had to learn the hard way: don’t hardcode credentials. Use a secret manager — AWS Secrets Manager, HashiCorp Vault, 1Password Secrets Automation — and scope keys to the minimum permissions the service actually needs. A Cloudflare key that only manages DNS records for one zone cannot create Workers or redirect CDN traffic.
The less obvious fix is Subresource Integrity (SRI). When you embed a third-party script, you’re trusting that CDN to never serve you something malicious. SRI lets you specify a cryptographic hash of the expected file content:
<script src="https://cdn.brevo.com/js/sdk-loader.js"
integrity="sha384-[hash]"
crossorigin="anonymous"></script>If the CDN serves a tampered file, the browser rejects it. The Brevo attack would have failed silently on every site using SRI on those script tags. It takes ten minutes to implement. Most production sites don’t do it.
Brevo moved fast once they identified the attack — revoked the key, removed the Worker, purged caches, published a post-mortem within three days. That’s a reasonable incident response. The problem is the credential shouldn’t have been there in the first place.
