A security incident at marketing platform Brevo caused malicious code to be delivered through scripts embedded on customer websites on 14 September 2026.
In its post-mortem, Brevo said an attacker used a compromised Cloudflare API key to deploy malicious code through the company's web infrastructure. For part of the incident, that code was added to three JavaScript files used by customers on their own websites, including Brevo forms, its Conversations widget and a loader used to add Brevo functionality to websites.
Selected visitors were shown a fake Cloudflare verification page that instructed them to paste and run a command on their Windows computer. Following those instructions downloaded malware. On WordPress websites using an affected Brevo widget, the script also attempted to install and activate a plugin when a logged-in administrator visited the site.
The websites themselves did not need to be hacked
Brevo says the attacker obtained a long-lived Cloudflare API key with broad account permissions that had been stored in application source code. The attacker then used a Cloudflare Worker to alter content as it was delivered through Brevo's content delivery network, rather than changing Brevo's original website files.
That distinction is important for businesses using externally hosted website tools. A company's own CMS, hosting account and website files can remain unchanged while code loaded from a trusted supplier behaves differently in a visitor's browser.
Brevo says the wider incident affected its public websites from 15:01 until 20:30 UTC on 14 September. The malicious code began being appended to customer-embedded JavaScript files at 16:07 and continued until the incident was stopped at 20:30. Brevo said its main application at app.brevo.com, its API, email-sending infrastructure and customer account data were not affected.
Independent research from ADAMnetworks documented the malicious verification prompt appearing through Brevo-connected pages and scripts, including on a Shopify storefront. BleepingComputer also reported that the attempted WordPress plugin acted as a persistent backdoor and JavaScript loader.
Brevo has revoked the compromised access
Brevo says it removed the malicious Worker and associated routes, revoked the compromised key and other credentials created with it, cleared affected caches and verified that the affected pages and scripts were serving clean content.
The company has also replaced the exposed credential with more narrowly scoped, short-lived tokens and says it is introducing stronger monitoring of Cloudflare changes, external scanning of public pages and scripts, and further protection for embedded assets. Brevo states that its Conversations widget, SDK and forms are now safe to use.
What affected website owners should consider
Brevo has issued specific advice for customers who may have been exposed. WordPress administrators whose sites loaded Brevo scripts and who visited while logged in on 14 September are advised to check whether any plugin was installed or activated that day, remove anything unexpected and change administrator passwords. Anyone who followed the fake verification instructions and ran the pasted command should treat that computer as compromised.
The incident also gives businesses a concrete reason to know which external services their websites depend on. Analytics, chat, marketing forms, payment tools and other integrations can all introduce code controlled by another supplier. Roled's recent Hub article on reviewing third-party website scripts explains how to identify those dependencies and decide whether each one still has a clear purpose and owner.
