Affected Systems

Brevo CRM/marketing platform and up to 100,000 customer websites embedding Brevo forms, Conversations widget, or SDK loader scripts. Affected domains: brevo.com, sendinblue.com, login/account/my/onboarding.brevo.com, sibforms.com. Exposure window: September 14, 2026, 16:07-20:30 UTC (5.5 hours). WordPress sites with Brevo widgets targeted for malicious plugin installation if admin logged in during attack window.

Exploitation Status

Active exploitation confirmed. Attackers used stolen Cloudflare API key (hardcoded in source code, possibly compromised late August 2026) to deploy malicious Cloudflare Worker. Attack delivered ClickFix social engineering lures and attempted WordPress backdoor installation via fake "Web Media Optimizer" plugin. Malicious infrastructure active September 14-15, 2026; now remediated by Brevo.

Business Impact

High-impact supply-chain compromise affecting downstream customer websites. Attackers bypassed integrity checks by rewriting responses at CDN edge and removing Content-Security-Policy headers, leaving origin servers unmodified. WordPress admins visiting affected sites while authenticated risked backdoor installation with hardcoded auth bypass, enabling persistent attacker access. Brevo's API, email delivery, and customer account data reportedly unaffected. Incident follows separate SSO compromise on September 10 affecting Trezor (347,000 emails exposed, 2,500+ accounts compromised); connection between incidents unconfirmed.

Urgency

🔴 Immediate

Recommended Actions

  • WordPress admins: immediately audit plugins installed or activated on September 14, 2026, especially hidden or must-use plugins; remove any suspicious entries including 'Web Media Optimizer' or plugins contacting glegchner.com, corralos[.]beer, sendibt1[.]com, yelahaye[.]surf, or boiseno[.]club
  • Rotate all WordPress administrator passwords if site embedded Brevo forms, Conversations widget, or SDK scripts and admins were logged in September 14, 16:07-20:30 UTC
  • Review Cloudflare and CDN configurations: remove hardcoded API keys from source code, rotate all long-lived API tokens, enforce short-lived tokens with least-privilege scopes, and enable alerting for Worker/route/DNS record creation
  • Monitor web application firewall and CDN logs for unexpected Worker deployments, edge-level content modifications, or removal of security headers (e.g., Content-Security-Policy) between late August and September 15, 2026
  • If using Brevo: verify integrity of embedded scripts, review access logs for anomalous activity during exposure window, and assess whether visitors were exposed to ClickFix lures or malicious downloads