Brevo Supply Chain Attack Injects Malware Into 100,000 Websites

Attackers abused a compromised long-lived Cloudflare API key for Brevo to deploy a malicious Cloudflare Worker (active ~5.5 hours, serving malware ~4 hours) that injected scripts into brevo.com, sibforms.com, and third-party sites using Brevo-embedded JavaScript. The payload performed ClickFix social-engineering to trick visitors into executing attacker-supplied commands and attempted to install a malicious WordPress plugin when administrator sessions visited, potentially affecting over 100,000 websites; Brevo recommends auditing WordPress plugins, rotating credentials, and scanning affected users' machines.