Brevo embedded scripts delivered ClickFix and WordPress malware

Websites using Brevo's chat and tracking scripts delivered an attack through a supplier they already trusted on September 14. Sansec found altered JavaScript on Brevo's infrastructure and embedded customer pages. A site owner did not have to install a new plugin or change a page for the malicious script to reach visitors.

The injected code loaded another script from subdomains of Brevo's sendibt1.com domain. It then chose between two paths: attempting a plugin installation through a logged-in WordPress administrator, or presenting other visitors with a fake human-verification prompt that asked them to paste and run a command.

Sansec did not recover the WordPress plugin, so its suspected backdoor function remained unverified. The firm's monitoring recorded 2,549 policy-violation reports across 12 sites, not that many infected people. Its estimate of more than 100,000 sites embedding Brevo services described potential reach rather than a confirmed victim count.

The observed distribution window ended at 20:12:53 UTC, but cached copies generated reports into the following day. Sansec suspected compromise of Brevo's Cloudflare account from infrastructure evidence; Brevo had not confirmed that explanation. Cleaning the supplier's live scripts therefore did not immediately remove every copy already held downstream.