Brevo's status write-up says that on 14 September 2026 an attacker used a compromised long-lived Cloudflare API key (stored in Brevo application source code; Brevo says it was first misused in late August) to deploy a Cloudflare Worker that rewrote responses at the CDN edge. Brevo gives the impact window as 15:01 to 20:30 UTC (5h29): the Worker was routed to all of brevo.com at 15:01, and at 16:07 it was updated to also append a loader to the three embedded JavaScript files and routed to sibforms.com; Brevo says the ClickFix was active on the listed URLs from 16:07 until 20:30 UTC.

Affected: brevo.com, sendinblue.com, login/account/my/onboarding.brevo.com, sibforms.com, plus Brevo forms script, Conversations widget, and SDK loader that customers embed. The Worker stripped CSP and served a fake Cloudflare “verify you are human” ClickFix lure (Win+R / Ctrl+V / Enter) downloading malware on Windows; Brevo says that on WordPress sites embedding a Brevo widget, if the visitor was logged in as an administrator, the script also attempted to silently install and activate a plugin.

Not affected per Brevo: app.brevo.com, API, email delivery, and customer account data held in Brevo. Remediation: Worker/routes/hostnames removed, key revoked, hardcoded credential removed, Vault + Cloudflare audit alerting planned. Distinct from Brevo’s earlier 9–10 September SSO boundary incident (Trezor phishing wave).

Primary: Brevo status write-up. Updated 17 Sep 2026: BleepingComputer reported that Sansec, which first reported the attack, said it may have affected up to 100,000 websites, gave the malicious window as 16:05 to 20:13 UTC, and that BleepingComputer found the plugin, named 'Web Media Optimizer', on VirusTotal. (source: BleepingComputer)

Correction (24 Oct 2026): an earlier version paired 'about five and a half hours' with 16:07–20:30 UTC; Brevo's 5h29 is its 15:01–20:30 UTC window. (source: Brevo status write-up)