A supply-chain attack involving Brevo-hosted scripts exposed more than 100,000 websites to malicious code on 14 September. The attackers used the compromised resources to target WordPress administrators with a plugin upload attempt and show other visitors a fake verification prompt. Researchers say the incident highlights how a single trusted supplier can put many sites at risk.
Key takeaways
The incident involved altered Brevo scripts, but that does not mean every site reached was successfully infected. Sansec observed the activity for about four hours and reported that the malicious hosts stopped resolving the following day.
- Logged-in WordPress administrators were targeted with an attempted plugin installation.
- Other visitors saw a ClickFix prompt urging them to paste and run a command.
- Site owners should check logs, plugins and files, while anyone who ran the command should scan their device.
How the attack worked
Sansec traced the malicious activity to Brevo resources, including scripts used by its website tracker and chat widget. Websites that embedded the affected components could load the hostile code without their own administrators changing the site. The activity was recorded between 16:05 and 20:13 UTC on 14 September.
If a visitor was logged in to WordPress, the script tried to upload a plugin using that active administrator session. Researchers could not recover the plugin, so its capabilities remain unconfirmed, although they suspect it was intended to provide backdoor access. Other visitors were shown a full-screen fake human-verification check. This ClickFix tactic relies on persuading a person to run a command, rather than exploiting a browser vulnerability.
What site owners should check
Administrators who used Brevo’s tracker, chat widget or hosted forms should review server logs for unexpected plugin-upload requests to /wp-admin/update.php?action=upload-plugin and plugin activations. Check plugins installed or changed on 14 September, including for unfamiliar files that may not appear in the WordPress dashboard. Sansec recorded 2,549 content-security-policy violation reports across 12 monitored sites, but that figure does not establish how many sites were compromised.
Anyone who followed a suspicious verification prompt and ran its command should run a full antivirus scan and look for unusual device behaviour. Legitimate websites do not ask visitors to open a terminal or command prompt to prove they are human.
Why routine WordPress care matters
Brevo’s affected files were restored, and the malicious domains stopped resolving on 15 September. Sansec suggested attackers may have accessed Brevo’s Cloudflare environment, but that proposed root cause has not been confirmed. The incident was separate from a Brevo account breach disclosed on 10 September, which affected customer accounts.
A WordPress maintenance plan or care plan can help site owners keep plugins and files under review, maintain reliable backups and respond quickly when a supplier reports an incident. Monitoring third-party scripts, limiting administrator access and keeping logs can also make it easier to spot suspicious changes before they become a bigger problem.