One Hacked Email Tool Weaponized 100,000 Websites Against Their Own Visitors

The Attack Started With One Login. Then 100,000 Sites Became a Trap.

On September 10, attackers quietly broke into Brevo. Not with a brute-force password spray. Not through a phishing email. They exploited a flaw in Brevo's SAML single sign-on system, the authentication layer that lets employees log in through a central identity provider. That one technical weakness gave them access to 138 customer accounts without triggering a single password alert.

Then they waited.

Four days later, they used something they found inside: a long-lived Cloudflare API key. An API key is a permanent password for a service. "Long-lived" means it never expired. On September 14, between 4:05 PM and 8:13 PM UTC, they used that key to reach into Brevo's CDN infrastructure and plant malicious code.

CDN stands for content delivery network. It's the system that serves website scripts, fonts, and tracking tools to millions of browsers at once. Brevo's CDN powers the tracking and email widgets that businesses embed on their websites. When attackers corrupted it, every site relying on Brevo instantly became a delivery vehicle for malware.

No individual site owner had done anything wrong. Their code was fine. Their hosting was fine. Their plugins were fine. But because they trusted Brevo, their visitors were now in danger.

What Did Visitors Actually See?

Every person who landed on one of the 100,000-plus affected sites was shown a fake "Cloudflare verification" page. It looked official. It had the right branding. It told them to run a command on their Windows computer to prove they weren't a bot.

This is a technique called ClickFix. The command, if run, installs malware. There is no verification happening. The entire prompt exists to trick people into handing over access to their own machine.

It gets worse. You didn't have to visit a business website to be exposed. If you clicked an unsubscribe link inside any Brevo marketing email, you were redirected through Brevo's infrastructure and shown the same fake page. Trying to opt out of marketing emails landed you in the same trap as someone browsing an online store.

For WordPress site owners, the threat was more severe. Any logged-in WordPress administrator who visited an affected site had a backdoor plugin silently installed on their site. Not prompted. Not asked. Installed. An attacker with a backdoor plugin can do essentially anything: steal user data, serve more malware, lock you out of your own site.

How Big Is Brevo?

Brevo is not a niche tool. Its customers include eBay, Louis Vuitton, and Michelin. Alongside those recognizable names are tens of thousands of small businesses, independent creators, newsletters, and online stores. All of them, for roughly four hours on September 14, were unknowingly redirected into an attack.

Brevo removed all malicious code by September 15.

Four hours of exposure across 100,000-plus sites, touching every single visitor during that window. The number of people who saw that fake Cloudflare prompt runs into the millions.

What Should You Do Right Now?

If you run a website:

1. Check whether your site uses Brevo for email marketing, forms, or tracking widgets. Log into your Brevo account and review the account activity log for anything suspicious around September 10 and September 14.
2. If you run WordPress, log into your admin dashboard and go to Plugins. Look for anything installed after September 13 that you do not recognize. Deactivate and delete it immediately. Change your WordPress admin password.
3. Rotate every API key connected to your Brevo account. API keys that never expire are a systemic risk. Set expiration dates on every key you issue going forward, across every service you use.
4. Enable two-factor authentication on your Brevo account if you haven't. Prefer an authenticator app over SMS.
5. Ask your other third-party marketing and analytics tools the same question: what does their CDN touch on my site? Every external script you embed is a surface you don't fully control.

If you are a visitor or newsletter subscriber:

1. If you visited a business website or clicked an unsubscribe link between approximately noon and midnight UTC on September 14 and saw an unusual Cloudflare verification box, do not assume your machine is clean. Run a full scan with a reputable security tool like Malwarebytes.
2. If you followed the prompt and ran a command, treat your machine as compromised. Change passwords to your critical accounts from a different device. Contact your bank if you use that machine for financial transactions.
3. For future reference: real browser verification from Cloudflare never asks you to open a command prompt or paste a command. If you ever see that instruction, stop immediately.

The Systemic Truth Behind This Attack

The Brevo incident is not really about Brevo. It's about the invisible supply chain behind every website you visit.

When you load a business's website, you are not just connecting to that business. You are connecting to whatever CDN they use, whatever email tool they use, whatever chat widget, analytics script, and payment tracker they use. Each one of those vendors has its own infrastructure, its own access keys, its own security posture.

You trust the website. The website trusts the vendor. If the vendor fails, you are exposed, and you never had any way to know it.

That is the leverage attackers are chasing. One key, one API credential, one unpatched authentication flow inside a single marketing platform. That's enough to turn 100,000 legitimate, trusted websites into a distribution network for malware.

The attack surface for any business is no longer just their own code. It is every tool they have ever embedded.

Do this now:

• Audit the third-party scripts running on your site
• Rotate API keys and set expiration dates
• Enable two-factor authentication on every marketing and analytics platform you use
• If you run WordPress, check your plugins for anything unfamiliar installed after September 13
• If you visited a suspicious Cloudflare prompt on September 14, scan your machine today

Sources

• bleepingcomputer.com
• securityweek.com