A significant security breach occurred when a supply-chain attack involving Brevo transformed widely used web tools into vectors for malware distribution. The attackers embedded harmful JavaScript into services accessed by customer websites, potentially compromising both visitors and WordPress site administrators.
Widespread Impact Across Websites
The breach affected over 100,000 sites as of September 14. Users accessing impacted sites, including chat features, sign-up forms, or email unsubscribe pages, faced deceptive prompts urging them to run a command.
Researchers from Sansec uncovered this two-pronged operation by examining modified scripts across Brevo’s services and customer applications. The first approach targeted logged-in WordPress administrators, while the second used a ClickFix overlay on general site visitors.
Sansec’s report to Cyber Security News emphasized the rapid proliferation risk when a shared web component is compromised. The attack demonstrated how breaching a single service can swiftly affect a vast audience.
Details of the Brevo Supply Chain Attack
The offending code was distributed between 16:05 and 20:12 UTC on September 14, appearing on Brevo pages and in JavaScript utilized by website trackers and chat widgets. This posed risks wherever these components were integrated.
For WordPress administrators already logged in, the script attempted to install a plugin during their session. Though the plugin was not recovered, it is suspected to be a backdoor, a known threat with certain WordPress plugins offering covert access.
For other users, the script presented a full-page ClickFix prompt, masquerading as a human verification step. This trick placed a command on the clipboard, prompting users to execute it, thus turning a familiar web interaction into malware execution without exploiting browser vulnerabilities.
Response and Preventive Measures
The malicious hosts ceased operation on September 15, and the original code was reported clean. However, cached copies and compromised sites remain a concern, underscoring the need for vigilance.
Sansec’s findings suggest a second-stage event affecting shared infrastructure, highlighting that even sites without stolen credentials could be impacted by attacks on hosted assets. This incident underscores the importance of monitoring third-party scripts and limiting administrative access.
Site owners using the affected tools should inspect server logs for unauthorized WordPress uploads or activations from September 14. Visitors who executed the fake verification command should conduct comprehensive antivirus scans and report any unusual activity.
To mitigate future risks, security teams should preserve relevant logs, reset privileged accounts if necessary, and remain alert for unfamiliar changes. Monitoring third-party JavaScript can help prevent a single supplier compromise from escalating into a widespread site breach.
The evidence indicates potential access to Brevo’s Cloudflare environment, enabling DNS changes and altered responses across domains. Though not confirmed as the root cause, this highlights the critical need for stringent monitoring and rapid response capabilities post-incident.
