A Compromised API Key, a Malicious Worker
Attackers used a compromised, long-lived Cloudflare API key belonging to email-marketing platform Brevo to deploy a malicious Cloudflare Worker on September 14, 2026. Investigation later revealed the key had actually been misused as early as late August 2026, well before the visible injection event.
Once deployed, the worker injected malicious scripts into brevo.com, sibforms.com, and three JavaScript files embedded on customer-owned websites — meaning the blast radius extended well beyond Brevo's own infrastructure into every site running Brevo's embedded scripts.
What the Injected Script Did
The malicious payload had two distinct functions:
- ClickFix social engineering — a fake "Cloudflare, verify you are human" page was displayed to visitors, attempting to trick them into copying and executing a malicious command themselves (the increasingly common ClickFix technique).
- WordPress targeting — on WordPress sites, the script attempted to install and execute a malicious plugin if the visiting session held administrator credentials, giving attackers a persistent foothold independent of the original injection point.
Scale and Duration
According to cybersecurity firm Sansec, the malicious worker was active for roughly five and a half hours before removal, with malware actually served to visitors for approximately four hours of that window. Sansec estimates more than 100,000 websites were likely impacted given the reach of Brevo's embedded scripts across its customer base.
No specific threat actor has been publicly attributed to the attack.
Remediation
Brevo is advising affected site operators to:
- Audit WordPress installations for unauthorized or unrecognized plugins installed during the exposure window and remove any found
- Rotate credentials, particularly for any admin accounts that may have browsed a site during the active injection period
- Advise site visitors who encountered the fake "verify you are human" page to scan their machines for malware, since ClickFix relies on the victim manually running attacker-supplied commands
More broadly, this incident is another reminder that long-lived API keys for infrastructure providers like Cloudflare are a high-value target — scoping keys narrowly, setting short expirations, and monitoring for anomalous Worker deployments can all reduce the blast radius when a key is eventually compromised.