Loading story…
Attackers used a stolen, long-lived Cloudflare API key with full account permissions to deploy a malicious Cloudflare Worker across Brevo zones. On September 14, the Worker rewrote CDN-edge responses, removed security headers, and injected malicious JavaScript into Brevo pages and customer sites using Brevo tracker, chat-widget, and hosted-form assets. The activity used attacker-controlled cdn*.sendibt1.com infrastructure and may have exposed more than 100,000 websites over roughly four to five-and-a-half hours.
Visitors to affected sites received ClickFix social-engineering overlays designed to persuade them to copy and execute malicious commands, while logged-in WordPress administrators were targeted with attempted installation of a persistent, unknown plugin. Brevo removed the Worker, revoked exposed credentials, eliminated hardcoded secrets and attacker-controlled hostnames, and purged edge caches; it said its application, API, mail-delivery infrastructure, and customer-account data were not affected. Organizations using Brevo web assets should investigate for unauthorized WordPress plugins and assess endpoints where users may have followed the ClickFix prompts.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
All identified malicious cdn*.sendibt1.com hosts stopped resolving, and Brevo origin-hosted assets were reported clean. Sansec advised affected organizations to investigate WordPress installations and endpoints whose users followed the ClickFix prompt.
The injected payload attempted to upload a malicious WordPress plugin when it detected a logged-in administrator; the plugin was designed for persistence and could load further JavaScript. Other visitors received a fake Cloudflare verification overlay using ClickFix instructions to induce Windows users to run a command.
Attackers abused a stolen, full-permission Cloudflare API key to deploy a malicious Worker that rewrote Brevo CDN-edge responses from approximately 16:07 to 20:30 UTC. The Worker removed security headers and injected malicious JavaScript into Brevo sites and customer-embedded forms, chat widgets, and SDK loaders, potentially affecting more than 100,000 sites.
Brevo disclosed a separate incident involving abuse of a SAML SSO flaw affecting 138 customer accounts. Brevo said the attacker lost access at 08:30 UTC that day.
A TLS certificate for cdn.sendibt1.com was created, indicating the attacker-used subdomain existed before the later supply-chain attack.
Brevo removed the malicious Cloudflare Worker and routes, revoked the exposed API key and credentials created with it, removed the hardcoded secret, deleted attacker-controlled hostnames, and purged edge caches. It stated that its application, API, mail-delivery infrastructure, and customer-account data were unaffected.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 24 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors covertly compromised **250+ legitimate WordPress websites**—including small businesses, regional media outlets, and at least one **U.S. Senate candidate** campaign site—and used them as distribution points for an **infostealer** operation. Rapid7 reported that attackers injected malicious code into the compromised sites to display a convincing **fake Cloudflare CAPTCHA** page that instructs visitors to **copy and execute a command** on their own machines, leveraging the **ClickFix** social-engineering technique to initiate malware delivery. Once executed, the malicious command leads to installation of credential-stealing malware capable of exfiltrating **browser-stored credentials**, **authentication cookies**, and **cryptocurrency wallet data**, with stolen “logs” potentially monetized on cybercrime forums. Reporting indicates the campaign has been active since **December** and shows signs of **high automation** across unrelated WordPress instances; Rapid7 also noted attacker-controlled domains used in the operation were registered around **July–August**, and the firm said it **notified U.S. authorities** to support investigation and remediation.
Jul 1, 2026
Threat researchers reported continued evolution and operationalization of **ClickFix**-style social engineering, where victims are tricked into manually executing attacker-supplied commands via the Windows Run dialog. Huntress described a new variant dubbed **CrashFix**, attributed to **KongTuke**, which uses a **malicious browser extension** to display a fake “browser stopped abnormally” security warning and a bogus “scan” flow; the extension silently places a **PowerShell** command on the clipboard, disguised as a legitimate repair action, and instructs the user to paste-and-run it, leading to code execution. Rapid7 Labs separately documented a large-scale campaign in which an unidentified actor compromises legitimate **WordPress** sites to inject a ClickFix implant that impersonates a **Cloudflare human verification (CAPTCHA)** challenge. The operation has affected **250+** infected sites across **12+ countries** and delivers a **multi-stage, mostly in-memory** malware chain (obfuscated JavaScript → PowerShell stagers → in-memory loaders/shellcode) aimed at stealing **credentials and digital wallets** from Windows systems, enabling downstream financial theft and potential follow-on intrusion using harvested credentials.
Jun 29, 2026
A cybercrime campaign compromised more than 5,400 primarily small-business WordPress and PrestaShop websites to serve **ClickFix** malware lures. Injected scripts use EtherHiding to retrieve payloads and configuration from smart contracts through BNB Smart Chain (BSC) Testnet RPC endpoints, providing attacker infrastructure that is difficult to remove and can be remotely updated. Visitors receive a fake CAPTCHA instructing them to paste a PowerShell command into the Windows Run dialog, causing malware to be downloaded and executed. The operators later replaced the ClickFix delivery chain with a WebRTC data-channel stager that connects to a hardcoded command-and-control server and dynamically executes JavaScript in browser memory. Researchers observed more than 300 infected sites active daily; nearly 400 sites contacted BSC Testnet endpoints each day in August, peaking at 536.
Sep 10, 2026