Attackers compromised Brevo, the email-marketing and customer-engagement platform, and used it to push malicious JavaScript to as many as 100,000 websites. On September 14, a rogue Cloudflare Worker injected fake "verify you are human" pages, a ClickFix trick that tells visitors to run commands on their own machines, into Brevo's forms script, Conversations widget and SDK loaders. The code was live for about 5.5 hours, from 16:05 to 20:12 UTC.
The intrusion began on September 10, when attackers exploited a SAML single sign-on flaw to reach 138 Brevo accounts, including that of crypto-wallet maker Trezor. They exported contacts from 43 accounts and sent phishing mail from six. Four days later they returned with a long-lived Cloudflare API key. Brevo says the Worker rewrote responses at the edge and stripped security headers such as Content-Security-Policy, while its origin servers stayed untouched, which made the attack harder to spot. Where a visitor was logged in to WordPress as an administrator, the script also tried to install a plugin, likely a backdoor.
Brevo has removed the Worker and revoked the key, and is investigating API key misuse dating back to late August. WordPress admins who were logged in on September 14 should check for plugins installed that day, remove any they do not recognise and rotate their passwords. The case shows how a single third-party script can hand attackers the visitors of thousands of unrelated sites at once.