DEV Community

Anoymask
Anoymask

Posted on

Brevo Supply Chain Attack: Edge Injection of ClickFix via Cloudflare Workers

#security #threatintel

1. Basic Information

2. Executive Summary

An attacker who obtained a highly privileged Cloudflare API key belonging to Brevo rewrote responses in transit at the CDN edge. They attempted to deliver ClickFix, which prompts users to execute terminal commands, and tried to install unauthorized plugins on WordPress sites.

3. Attack Flow

The common starting point was delivery modification at the Cloudflare edge. Subsequent actions are divided into Path A, which prompts visitors to run commands, and Path B, which abuses the sessions of logged-in WordPress administrators. Path B does not depend on the completion of Path A.

Common Preparation: Delivery Modification at the Cloudflare Edge

  1. The attacker obtained a highly privileged Cloudflare API key belonging to Brevo.
  2. The attacker created a Worker (a script running at Cloudflare's edge), routes, and DNS records, and removed the Content Security Policy (CSP) headers that restrict script execution from web responses.

Attack Path A: ClickFix Targeting Visitors

  1. Due to this delivery modification, fake Cloudflare verification screens were delivered to some visitors via JavaScript embedded in Brevo web pages and customer sites. Brevo states that these fake screens appeared selectively and were not shown to the majority of visitors or upon revisits.
  2. If a user followed the fake screen's instructions and pasted and ran a command in the Windows Run dialog, the command executed on the device and downloaded additional malware.

Attack Path B: Unauthorized Plugin Deployment Targeting WordPress Administrators

  1. When a logged-in administrator accessed a WordPress site embedded with the Conversations widget (a chat embedding script), their browser received the modified delivery script. This path does not assume that a user executed commands via Path A.
  2. The script abused the administrator's authentication session in an attempt to install and activate an unauthorized plugin (the sample confirmed by BleepingComputer was named Web Media Optimizer).
  3. The installed plugin included features to deliver additional JavaScript and to improperly create administrator sessions. However, this was confirmed based on functional analysis of the sample and does not indicate successful installation across all target sites.

4. Attacker Location and Execution Point

  • The attacker remotely controlled Brevo's Cloudflare account using the compromised API key.
  • Instead of compromising origin servers, the attacker rewrote responses at Cloudflare edge locations, directly abusing Brevo's legitimate delivery channels.

5. Perspective of Victims and Administrators

Victims

  • A fake screen disguised as Cloudflare authentication appears, asking the user to open the Windows Run dialog and paste and execute a command.

Administrators

  • Because the files on Brevo's origin servers were not modified, server-side file integrity monitoring alone could not detect the edge modifications. Relevant clues include Cloudflare audit logs, changes to Workers, routes, and DNS records, and missing CSP headers in delivered responses.

6. Success and Failure Conditions

Success Conditions

  • From the attacker's perspective, the compromised API key must have permissions to modify Workers, delivery routes, and DNS settings.
  • During the time window when modifications are served, target sites or visitors must load Brevo's delivery assets. For ClickFix to succeed, users must execute commands as instructed. For the WordPress path to succeed, an active administrator session and plugin installation privileges are required.

Failure Conditions

  • If defenders revoke API keys, delete unauthorized Workers, routes, and DNS settings, and clear the CDN cache, the delivery of modified scripts stops.
  • If a user cancels the paste operation or endpoint EDR blocks suspicious process execution, infection via ClickFix fails.
  • In WordPress environments, restricting plugin installation privileges or prohibiting unauthorized plugins can prevent damage from administrative session abuse.

7. What Happens Upon Success

  • Arbitrary command execution on endpoints via ClickFix, followed by malware infection.
  • Establishment of persistent backdoors and delivery of additional JavaScript through unauthorized plugin installation on WordPress sites.
  • Spread of damage to external sites and their visitors who trusted legitimate delivery channels.

8. Observable Logs

Email

  • The primary vector in this incident is web delivery. Email-based investigations are not assumed.

Proxy / SWG / DNS

  • Inference: Check access logs to Brevo and sendinblue assets during the impact window, alongside communications fetching suspicious external scripts and payloads immediately afterward.

Endpoint / EDR

  • Inference: Check processes launched from the Windows Run dialog, along with subsequent communications and execution logs. While powershell.exe, cmd.exe, and mshta.exe are candidates for review, not all of them were necessarily used in this incident. Check beyond browser child processes.

Identity / IdP

  • Inference: Review session and administrative activity logs for WordPress and Brevo administrators to check for unusual source IP addresses, timeframes, or privilege changes.

SaaS / Cloud

  • Inference: Check Cloudflare API token usage history, Worker, route, and DNS creation events, and modifications to CSP headers or cache settings. On the WordPress side, check plugin installation history.

Network

  • Inference: Correlate suspicious external communications occurring right after connecting to legitimate Brevo delivery servers with endpoint process execution logs. Avoid concluding that malware executed based solely on network connection events.

9. Attack Success Determination

Confirmed in Public Information

  • Attack Attempt Observed (Success Unconfirmed): Public information: Brevo has confirmed modified delivery at the edge and attempts to install and activate unauthorized plugins on WordPress. The number of victims who executed ClickFix or sites where plugin installation succeeded has not been disclosed.

Determination Criteria for Your Organization

  • Attack Attempt Observed (Success Unconfirmed): Criteria: Receipt of modified responses, display of fake verification screens, or arrival of plugin installation requests during the relevant time window. Screen displays or HTTP request arrivals alone do not confirm successful execution.
  • Initial Execution Confirmed: Criteria: Confirmation via endpoint or server records of unauthorized process startup following user actions, or unauthorized plugin activation and code execution. File downloads or saves alone do not confirm successful execution.
  • Subsequent Compromise Confirmed: Criteria: Addition of persistence settings, unauthorized creation of administrator sessions, or execution of additional payloads backed by individual evidence. Information theft scope is judged individually from outbound transmission and access logs.

10. Investigation Playbook

Trigger

  • Inference: Triggered by the use of Brevo embedded scripts during the impact window, user reports of fake Cloudflare screens, or detection of Web Media Optimizer.

Initial Response

  • Inference: Identify Brevo assets loaded on target sites, verify access times, establish what actions users took, and confirm the presence of WordPress admin sessions.

Endpoints and Servers

  • Inference: Preserve browser history and cache, available records of commands pasted from the clipboard and executed, launched child processes, downloaded files, and persistence artifacts.

Authentication and Cloud

  • Brevo advised users who logged in via brevo.com on September 14 to change their passwords and check their own API keys as a precautionary measure. This advice is not limited to users who executed ClickFix.
  • Inference: Check WordPress administrator authentication logs and administrative operation history. If your organization operates Cloudflare, investigate audit logs for that environment separately (revoking keys on Brevo's side and checking customer API keys are separate actions).

Subsequent Operations

  • Inference: Track external communications, credential access, and deployment of additional malware occurring after initial execution or plugin installation.

Containment

  • Brevo treats endpoints where users executed pasted commands as compromised, requiring isolation from the network, full scans, and password changes for credentials used on those endpoints.
  • For WordPress sites loading Brevo scripts, if a logged-in administrator was browsing on September 14, check plugins installed or activated that day, remove unauthorized ones, and change admin passwords.
  • Inference: Preserve evidence as much as possible before restoring the environment, and confirm no unauthorized plugins or additional payloads remain.

Decision Categories

  • Inference: Categorize and determine stages including receipt of modified responses, user actions, initial code execution, persistence, and data breach.

11. Defense and Detection Ideas

Single Event

  • Inference: Detect unauthorized creation of Workers, routes, and DNS in Cloudflare, disappearance of CSP headers, and installation of unauthorized plugins in WordPress.

Timeline Correlation

  • Inference: Correlate the transition from viewing Brevo assets to process execution via the Run dialog and external communication, or from viewing admin screens to plugin creation, in chronological order.

Hunting

  • Inference: Identify endpoints that accessed Brevo delivery during the relevant timeframe and administrative sites embedding the Conversations widget.

Log Gaps

  • Inference: Origin server logs and file integrity monitoring alone cannot detect edge modifications. Cloudflare audit logs and external periodic validation of delivered content are required.

Priority Mitigations

  • Inference: Organizations operating CDNs should implement least-privilege and short-lived API credentials, dedicated secret management, immediate alerts for Worker or route changes, and external CSP and delivery validation. Organizations using Brevo should carry out endpoint, WordPress, and account checks according to their usage type as outlined in Section 10.

12. Facts, Inference, and Hypothesis

Facts

  • Brevo stated that a long-lived, full-privilege Cloudflare API key hardcoded in source code was leaked.
  • The attacker created Cloudflare Workers, delivery routes, and DNS settings, overwriting HTML and JavaScript responses at edge locations to remove the Content Security Policy.
  • The impact window published by Brevo was 2026-09-14 15:01–20:30 UTC (5 hours and 29 minutes), with the expansion of modifications to embedded JavaScript and sibforms.com occurring at 16:07 UTC. Investigations indicate the first unauthorized use of the API key was in late August 2026, but no malicious content injection into customer pages was found prior to September 14. This does not specify when the key was acquired.
  • Affected components included Brevo's website, login and onboarding screens, form scripts, the Conversations widget, and the SDK loader. It was announced that app.brevo.com, APIs, email sending infrastructure, and customer account data were not affected.
  • Visitors were shown ClickFix prompting Win+R, pasting, and execution via a fake Cloudflare verification screen, while WordPress administrators faced attempted installation of unauthorized plugins.
  • Brevo completed the deletion of unauthorized Workers, routes, and hostnames, revoked compromised keys and derived credentials, and cleared the CDN cache. Keys in source code have also been migrated to short-lived, least-privilege tokens. Centralized secret management and automated rotation via Vault, change notifications, and external delivery monitoring are being advanced as enhancement measures.

Inference

  • File integrity monitoring on origin servers alone will miss response modifications at the CDN edge layer. Post-delivery responses, CSP headers, and edge configuration audit logs must be monitored via paths separate from the origin.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in "Unknowns and Further Investigation".

13. MITRE ATT&CK Mapping

  • T1195.002 Compromise Software Supply Chain (Confidence: high): Brevo's legitimate delivery script loaded by customer sites was modified at edge locations.
  • T1204.004 User Execution: Malicious Copy and Paste (Confidence: high): Utilized ClickFix techniques to prompt users to paste and execute commands.
  • T1505.003 Server Software Component: Web Shell (Confidence: medium): BleepingComputer's sample analysis confirmed capabilities for unauthorized creation of admin sessions and additional code delivery in the WordPress plugin. Mapped as a web server backdoor.

14. Unknowns and Further Investigation

  • The leakage vector of the Cloudflare API key and the time of its first acquisition by the attacker.
  • The number of users who actually executed ClickFix and the number of sites where unauthorized WordPress plugin installation succeeded.
  • All infrastructure operated by the attacker, deployed subsequent payloads, and the scope of secondary compromise.

15. Impact on SOCs and Organizations

Organizations embedding Brevo forms or Conversations widget on their sites should cross-reference access logs during the relevant time window, endpoint browser and EDR logs, and WordPress modification histories. Even if no anomalies are found in files on origin servers, organizations must independently verify whether unauthorized code execution or plugin installation occurred on visitor endpoints or their own sites.

16. Summary by Role

  • SOC: Inference: Chronologically correlate access to Brevo delivery during the relevant timeframe, suspicious command execution on endpoints, and WordPress plugin installation and activation.
  • Administrators: Check unauthorized WordPress plugins, admin passwords, Brevo passwords, and your organization's Brevo API keys, according to how the service was used on September 14. Do not assume confirmation is complete solely because Brevo revoked their Cloudflare keys.
  • Users: Do not execute commands if prompted via Win+R or pasting from a fake verification screen, and promptly report to your IT or security team if you have already run a command.

Top comments (0)