Brevo Supply Chain Attack: A Stolen Cloudflare API Key Exposed 100,000+ Sites

🚨 Brevo Supply Chain Attack: A Stolen Cloudflare API Key Exposed 100,000+ Sites

TL;DR: On Sept 14, 2026, a hardcoded Cloudflare API key let attackers deploy a malicious Worker on Brevo's infrastructure — injecting ClickFix malware and a hidden WordPress backdoor into 100,000+ sites, without ever touching origin files.

🔍 How it worked:

A long-lived Cloudflare API key with full account permissions was stored in Brevo's application source code. Once stolen, it let attackers create Workers, routes, and DNS records without triggering alerts.

The Worker sat between visitors and Brevo's origin server, rewriting responses in transit. Origin files stayed untouched — which is exactly why standard file-integrity checks saw nothing wrong.

⚔️ Two attack paths:

1️⃣ ClickFix malware — regular visitors saw a fake Cloudflare "Verify You're Human" page instructing them to press Win+R → Ctrl+V → Enter. The clipboard already held a malicious command.

2️⃣ WordPress backdoor — logged-in admins had a disguised plugin ("Web Media Optimizer") silently installed via their own session. It hides from the plugin list, drops into mu-plugins, and contains a hardcoded key for passwordless admin access. MFA at login wouldn't have stopped this — it rides an already-authenticated session.

🛡️ Quick defensive win for WordPress devs:

define('DISALLOW_FILE_MODS', true);

This single wp-config.php setting disables dashboard plugin/theme installs — blocking the exact silent-install path used here.

📋 What I cover in the full writeup:

• Confirmed timeline (per Brevo's post-mortem)
• Real IOCs for log hunting
• Nginx/WP-CLI/PowerShell detection commands
• Microsoft Defender KQL hunting query
• Full WordPress prevention checklist

If you maintain any WordPress site embedding Brevo widgets, this is a 10-minute read worth your time 👇

🔗 https://www.xpert4cyber.com/2026/09/brevo-clickfix-malware-wordpress-backdoor-attack.html