Brevo Supply Chain Attack Pushes WordPress Backdoors and ClickFix Malware to 100,000+ Sites

Key Takeaways

• A supply-chain attack against Brevo injected malicious JavaScript into widely used website components.
• Over 100,000 customer websites were affected on September 14, 2023.
• The attack deployed WordPress backdoors for administrators and ClickFix malware for general visitors.
• The incident highlights the amplified risk of compromising shared web services.
• While the original malicious code has been removed, cached copies and compromised sites may still pose a threat.

A sophisticated supply-chain attack targeting Brevo, a prominent customer relationship management platform, briefly transformed widely adopted website tools into a conduit for malware distribution. Threat actors injected malicious JavaScript into services that numerous customer websites integrate, thereby exposing both website visitors and WordPress administrators to significant risk.

The malicious activity impacted more than 100,000 customer sites on September 14, according to an investigation into the incident. Users interacting with affected websites through chat features, sign-up forms, or email unsubscribe pages were presented with a deceptive verification prompt, coercing them into executing a malicious command.

Researchers at Sansec said in a report that they uncovered this two-pronged operation by tracking compromised scripts across Brevo’s services and customer integrations. One vector specifically targeted logged-in WordPress administrators, while the other employed a ClickFix overlay to deceive ordinary website visitors.

Sansec emphasized that this incident underscores how a single compromised web component can rapidly escalate into a widespread intrusion. Instead of individually breaching multiple websites, attackers can compromise a shared service, leveraging its extensive reach to inject harmful content onto a vast number of platforms.

Brevo Supply Chain Attack Details

The malicious code was active between 16:05:18 and 20:12:53 UTC on September 14. It appeared directly on Brevo-hosted pages and within JavaScript files associated with a website tracker and chat widget. This widespread integration meant that any website embedding these Brevo components was exposed to the attack.

For visitors already logged into WordPress as administrators, the injected script attempted to install a plugin using their active session. While Sansec was unable to retrieve the specific plugin, they assessed it as a likely backdoor, consistent with known tactics involving trusted WordPress plugin backdoors. For other visitors, the script presented a full-page ClickFix prompt, masquerading as a human verification step. This prompt instructed users to copy a command to their clipboard and then paste and execute it, effectively turning a common web interaction into malware execution without exploiting any browser vulnerabilities.

Sansec’s monitoring recorded 2,549 Content Security Policy (CSP) violation reports across 12 websites during and immediately after the attack window. Although the malicious hosts ceased resolving on September 15 and the original code at Brevo was cleaned, concerns remain regarding cached copies of the malicious scripts and potentially compromised client sites.

Initial disclosures indicated six hijacked customer accounts, but Sansec’s findings suggest a more extensive second-stage compromise affecting shared delivery infrastructure. This distinction is critical because an attack on a hosted asset can impact numerous sites, even those whose individual account credentials were not stolen.

ClickFix Exposure and Response

The ClickFix malware operates on social engineering rather than silent exploitation. Its deceptive browser check persuades users to perform the final malicious step themselves. This technique mirrors recent ClickFix campaigns that leverage convincing prompts to turn clipboard actions into an initial foothold on a user’s device.

What You Should Do

• For Site Owners:
  • Review web-server logs for unauthorized WordPress plugin upload and activation requests that occurred on September 14.
  • Inspect all plugins installed or activated on September 14. Compare files on disk with the administrator console, as malicious plugins may be hidden from the standard list.
  • Preserve all relevant logs before they are removed by normal retention policies.
  • Reset privileged accounts if any suspicious activity is detected.
  • Implement robust monitoring for third-party JavaScript integrations and conduct rapid integrity checks after any supplier incidents.
  • Limit administrator sessions to reduce the attack surface.
• For Website Visitors:
  • If you followed a “human verification” prompt and executed a command on September 14, immediately run a full antivirus scan on your device.
  • Report any suspicious device behavior to your IT department or security provider.
  • Be aware that legitimate websites will never ask you to open a terminal, Run dialog, or command prompt to pass a security check.

The available evidence suggests that the attackers may have gained access to Brevo’s Cloudflare environment, allowing them to make DNS changes and alter responses across related domains. While this remains an assessment rather than a confirmed root cause, it highlights the critical importance of closely monitoring third-party scripts, restricting administrative access, and performing swift integrity checks following any supplier incident.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.