Poisoned Pipeline / Incidents / AS19
Brevo Cloudflare Worker ClickFix
On 14 September 2026 an attacker used a long-lived Cloudflare API key that
had been hardcoded in Brevo application source to deploy a Worker that
rewrote HTML and embedded JavaScript at the CDN edge for about five and
a half hours. Origin files were unmodified, so integrity checks on source
missed it. Sansec observed malware on Brevo pages and on 100k+ customer
sites embedding Brevo widgets: a ClickFix overlay plus a WordPress
backdoor plugin aimed at logged-in administrators. Brevo's own
post-mortem confirms the key, the Worker, and the window.
Mapped techniques
- T0189 Secrets in configuration files
- T0112 Compromised token
- T0205 Compromise third-party CDN or hosted web asset
- T0180 Compromise services / servers
- T0159 Malicious artifact execution
- T0119 Cross-site scripting
- T0138 Backdoor in code
- T0201 Customers compromised
supply-chain Brevo Cloudflare account
A Cloudflare API key with full account permissions was stored in
application source code (Brevo post-mortem).
The stolen API key created Workers, routes, and DNS records across
Brevo zones without an alert.
The Worker rewrote responses at the Cloudflare edge and stripped CSP;
origin was clean.
sendibt1.com is a Brevo-operated domain; attacker DNS/SSL on that
zone showed write access to Brevo's CDN naming.
post-supply-chain Customer sites embedding Brevo widgets
sdk-loader.js and brevo-conversations.js on customer origins loaded
extra attacker script.
Injected script ran in the context of customer sites and Brevo pages.
Logged-in WordPress admins were targeted with a silent plugin install
that persisted as a must-use plugin.
Sansec estimates 100k+ sites embedding Brevo components were in the
distribution path; visitors saw ClickFix, admins risked a backdoor.
Framework gaps noted
- Edge/CDN response rewriting (origin untouched) is only partly covered by T0205.