Your Marketing Vendor Just Delivered Malware to 100,000 Websites. Here's What the Brevo Attack Means for Your Business.

On September 14, 2026, tens of thousands of businesses got a hard lesson in supply chain risk — and most of them never knew it happened.

Brevo, a widely used email marketing and customer engagement platform, became the delivery mechanism for malware served to visitors across more than 100,000 websites. The culprit wasn't a zero-day vulnerability. There was no sophisticated nation-state attack technique. The root cause was something embarrassingly preventable: a long-lived API key with full account permissions, stored in plain text in application source code.

One stolen credential. Five and a half hours. One hundred thousand websites turned into a malware distribution channel — all while Brevo's own servers remained completely clean.

What Actually Happened

Attackers had accessed Brevo's environment as early as late August 2026, but the major blow landed on September 14. Using a compromised Cloudflare API key they'd extracted from Brevo's source code, the attackers deployed what's called a Cloudflare Worker — a lightweight piece of code that runs at the network edge, between Brevo's servers and every visitor's browser.

The Worker rewrote HTTP responses in real time. It modified three JavaScript files that Brevo customers embed directly into their own websites: the SDK loader, the Conversations widget, and the forms script. Because the Worker operated at the content delivery network (CDN) edge, it bypassed standard security headers — including Content Security Policy — and left Brevo's origin files completely untouched. Standard integrity checks saw nothing wrong.

What did website visitors see? A convincing fake Cloudflare verification page — the kind that's become so common that many users instinctively trust it. The page told Windows users to press a keyboard shortcut and run a command from their clipboard. That command downloaded malware.

On WordPress sites where a logged-in administrator visited an affected page, the attack went further: it silently attempted to install a backdoor plugin, creating persistent access that would survive even after Brevo cleaned up its own systems.

Brevo discovered and removed the malicious Worker by 20:30 UTC. Security firm Sansec, which tracked the incident, estimated the exposure window at roughly four hours and documented more than 100,000 websites in the blast radius.

Why This Is Every Business Leader's Problem

If your business uses Brevo — or any email marketing platform, analytics tool, chat widget, or customer engagement service — this story is about you.

Here's the uncomfortable truth: you almost certainly have third-party JavaScript running on your website that you didn't write, don't control, and probably haven't audited. These scripts are often embedded directly from vendor CDNs, loading fresh content with every page view. They have access to everything your website does — every form field, every click, every session.

When a vendor is compromised, that access becomes an attacker's access. And your users — your customers, your prospects — are the ones who pay the price.

The Brevo attack is particularly instructive because it succeeded without touching Brevo's core systems. The attackers didn't need to crack a database. They didn't need to bypass sophisticated security controls. They found one overprivileged credential hiding in plain sight, and that was enough.

Cybersecurity firm Sansec put it plainly: "On September 14, Brevo served malware to visitors of its own site and more than 100,000 customer sites." Brevo was both victim and, through no malicious intent of its own, the mechanism of attack.

The Hardcoded Credential Problem Is Everywhere

Storing API keys, passwords, and secrets directly in application source code is one of the most common and most dangerous development mistakes in existence. It happens constantly — in production codebases, in version control history, in deployment scripts, in build pipelines.

The Brevo key was described as a "long-lived" credential with "full account permissions." That combination — maximum privilege, no expiration — is a worst-case scenario. An attacker who finds it gets everything, indefinitely, with no natural expiry forcing a rotation.

GitHub alone scans billions of code commits looking for exposed secrets. In 2025, it found and blocked tens of millions of them. The ones it doesn't catch — private repositories, internal tools, deployment artifacts — remain ticking clocks.

This isn't a problem unique to Brevo or to marketing platforms. The same pattern has played out in payment systems, cloud storage buckets, CI/CD pipelines, and internal business applications. Every hardcoded credential is an attack waiting to happen.

The ClickFix Technique Is Getting More Dangerous

The social engineering component of this attack deserves attention. ClickFix — tricking users into copying and running malicious commands by disguising them as routine verification steps — has become one of the most effective attack techniques of 2026 precisely because it weaponizes user trust in familiar interfaces.

The fake Cloudflare verification page the Brevo attackers used wasn't some crude imitation. It was polished enough to fool visitors browsing legitimate business websites. The technique works because it doesn't require users to download and execute a suspicious file — it asks them to run what looks like a routine system command.

Employee awareness of this technique is no longer optional. If your team doesn't know what a ClickFix lure looks like, they're vulnerable.

Three Questions Every Business Leader Should Ask This Week

1. What third-party scripts are running on our website?

Most business leaders have no idea. Marketing teams add tracking pixels. Developers embed chat widgets. Analytics tools load asynchronously. Every one of these is a potential supply chain vector. Get an inventory. Understand what permissions those scripts have. Know which vendors you're trusting, implicitly, with your users' browsers.

2. Do we have secrets management in place — or do our developers store credentials in code?

This is a conversation worth having with your IT team or development partner this week. The answer should involve dedicated secrets management tools (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, or similar), short-lived credentials, least-privilege access, and automated scanning of code repositories for exposed secrets. If the answer is "we're not sure," that's your answer.

3. If our marketing or analytics vendor were compromised tomorrow, how quickly would we know?

Brevo's compromise went undetected for at least two weeks before the September 14 delivery event. For most organizations, vendor-side compromises are invisible until the damage is already done. Behavioral monitoring of third-party script activity, subresource integrity enforcement, and clear vendor incident notification requirements in contracts can close that gap.

The Bottom Line

The Brevo attack is a case study in how modern supply chains create risk that bypasses traditional perimeter defenses entirely. Your firewall didn't fail. Your endpoint protection didn't miss anything. A trusted vendor's infrastructure was weaponized against your users, and your security tools had no visibility into it.

This is exactly the threat model that keeps experienced security leaders up at night — and it's why vendor risk management has to be a business conversation, not just a procurement checkbox.

If you're not sure where to start, TrustPoint Cyber can help you build a vendor risk framework that's practical, not bureaucratic — one that gives you real visibility into the third parties you trust with your business and your customers.

Because in 2026, your vendors aren't just service providers. They're part of your attack surface.