For about five and a half hours on September 14, anyone loading a website that embedded a Brevo widget could have been served a fake verification page telling them to paste a command into Windows. Researchers put the exposure at up to 100,000 sites, spanning WooCommerce, Magento, Adobe Commerce and Shopware storefronts.
The entry point was a single long-lived Cloudflare API key with full account permissions, sitting hardcoded in Brevo’s own application source. With it the attackers created Cloudflare Workers, routes and DNS records inside Brevo’s account. None of that tripped an alert, because from Cloudflare’s side it was the account owner doing account owner things.
Modifying Content at the Edge
The malicious Worker rewrote responses at the CDN edge for brevo.com, sendinblue.com and related domains. Customer sites were never touched. They didn’t need to be, because they were loading a script from a domain that had been quietly repointed.
Visitors got a fake verification prompt and then ClickFix instructions, the social engineering pattern that has replaced the fake update download almost entirely this year. Logged-in WordPress administrators got special treatment: the script tried to install a backdoored plugin called Web Media Optimizer, which persists from the must-use plugins directory, phones home, and carries hardcoded authentication letting the operators mint an administrator session without a password.
Malicious subdomains stopped resolving by September 15. Brevo had also disclosed a separate incident four days earlier, an SSO breach used to hijack customer accounts and phish Trezor wallet holders. Two compromises in one week at the same vendor is a pattern, not bad luck.
The Marketing Stack Is Supply Chain and Nobody Treats It That Way
Security teams review the CI pipeline and the package registry. The tag manager, the chat widget, the email platform’s tracking script and the consent banner all load with the same privileges as first-party code, and they’re usually owned by marketing, procured on a credit card, and never reviewed again.
Brevo is a mid-market email and CRM platform. Its widget ended up on 100,000 sites, each of which inherited the security posture of a company most of their customers couldn’t name. Content Security Policy and subresource integrity would have blunted this, and almost nobody deploys either against a vendor script they consider trusted.
Where the Spend Goes
The exploitable mistake was a credential with no expiry and no scope limit living in code. That is the core pitch of the non-human identity security segment, which has been raising money hard for two years and now has a reference incident with a number attached. Secrets scanning, short-lived scoped tokens and provider-side alerting on Worker and DNS creation are all things a security buyer can act on this quarter.
The other lesson is about the edge itself. A CDN account is a content rewriting platform for every domain it fronts. It deserves the monitoring you’d give a domain registrar, and most firms give it the monitoring they’d give a cache.