A recent security incident involving Brevo (formerly Sendinblue) demonstrates how a compromise of a third-party service can quickly become a security incident for thousands of otherwise unrelated websites.
According to security research published by Sansec on September 16, 2026, attackers used compromised Brevo infrastructure to distribute malicious JavaScript to more than 100,000 customer websites. The attack could potentially install a malicious WordPress plugin on administrator sessions and display a ClickFix social-engineering overlay to website visitors.
This is a classic example of a software supply-chain attack: instead of compromising every website individually, attackers targeted a service that those websites already trusted and embedded.
What Happened?
Brevo provides email marketing, forms, chat, tracking and other services that are commonly integrated into websites through JavaScript widgets.
Sansec reported that on September 14, 2026, malicious code was served through Brevo-related assets used by customer websites.
Affected assets included:
- Brevo’s SDK loader
- Brevo Conversations chat widget
- Brevo-hosted forms
- Other Brevo-related embedded resources
Sansec observed malicious JavaScript being loaded from domains including:
cdn.sendibt1.com
cdn2.sendibt1.com
cdn3.sendibt1.com
cdn4.sendibt1.com
cdn9.sendibt1.com
cdn10.sendibt1.com
cdn11.sendibt1.com
The malicious code was observed being served between approximately 16:05 and 20:13 UTC on September 14, 2026. Sansec subsequently reported that the malicious hosts stopped resolving on September 15.
Why Was This Attack Particularly Dangerous?
The important point is that website owners did not necessarily have to install malicious software themselves.
A legitimate third-party JavaScript dependency was enough to become an attack vector.
The basic chain looked like this:
Brevo infrastructure compromised
↓
Malicious JavaScript injected into legitimate assets
↓
Customer websites load the compromised Brevo asset
↓
Malware executes in the customer’s browser
↓
WordPress administrators may receive a malicious plugin
OR
Regular visitors see a ClickFix social-engineering prompt
This significantly increases the attacker’s reach.
Instead of attacking individual websites one by one, compromising one widely used third-party service can potentially affect a very large number of websites simultaneously.
Two Different Attack Paths
Sansec identified two major behaviors in the malicious JavaScript.
1. WordPress Administrator Attack
When the malware detected a logged-in WordPress administrator, it attempted to install a WordPress plugin from the attacker’s infrastructure.
Sansec reported the following payload:
https://cdn10.sendibt1.com/p/wm.zipThe researchers were unable to recover the plugin itself but stated that it was likely a backdoor.
This is particularly concerning because an administrator’s authenticated browser session can provide the privileges necessary to install or activate plugins.
2. ClickFix Attack Against Visitors
For ordinary visitors, the malware could display a ClickFix-style overlay.
The victim is presented with a fake verification or “prove you are human” interaction and instructed to copy and paste a command.
The important security lesson is that this is not simply a website vulnerability.
The attacker attempts to convince the victim to execute the malicious command themselves.
This technique is increasingly being used because it can bypass some traditional browser and security controls through social engineering.
Sansec reported that the malware specifically attempted to avoid crawlers, developers and automated scanners.
Potential Root Cause
Sansec’s investigation suggests that the attackers may have obtained access to Brevo’s Cloudflare environment.
The researchers identified several indicators supporting this hypothesis, including changes involving Brevo-owned DNS infrastructure and malicious cdn* subdomains under sendibt1.com.
However, Sansec describes this as a possible root cause, rather than a conclusively established explanation.
Brevo’s earlier September 10 security incident involved an SSO flaw, according to the timeline reproduced in Sansec’s research. Sansec’s analysis indicates that the later September 14 activity involved a broader compromise of infrastructure used to distribute web assets.
The Timeline
| Date | Event |
|---|---|
| August 25, 2026 | cdn.sendibt1.com certificate created |
| September 10, 2026 | Brevo identifies an SSO flaw |
| September 14, 2026 – 16:04 UTC | Last clean sdk-loader.js observed |
| September 14, 2026 – 16:05 UTC | First malicious sdk-loader.js observed |
| September 14, 2026 – 20:12 UTC | Last observed malware activity from Brevo domains |
| September 15, 2026 | Malicious hosts stop resolving |
| September 16, 2026 | Sansec publishes its investigation |
What eCommerce Teams Should Do
1. Inventory Third-Party JavaScript
Create an inventory of every external script loaded by the storefront.
For example:
Google Tag Manager
Google Analytics
Brevo
Klaviyo
Meta Pixel
Hotjar
Chat widgets
Review platforms
Advertising platforms
Payment providers
A/B testing tools
Customer support toolsDon’t assume that a script is safe simply because it belongs to a well-known vendor.
2. Review Recently Changed Dependencies
Check:
- WordPress plugins
- NPM packages
- Composer packages
- CDN assets
- Tag Manager configurations
- Third-party JavaScript
- Cloudflare Workers
- DNS changes
- CI/CD deployments
Unexpected changes should be investigated.
3. Review Content Security Policy
A properly designed Content Security Policy (CSP) can reduce the impact of unauthorized script sources.
For example, avoid unnecessarily broad policies such as:
script-src *Instead, explicitly define the trusted sources required by the application.
For Magento/Adobe Commerce stores, CSP should be reviewed whenever a new third-party service is introduced.
4. Monitor Third-Party Scripts
One of the biggest lessons from this incident is that monitoring only your own source code is not enough.
Your application may be unchanged while the code delivered by a trusted external provider changes.
Consider monitoring:
- Script hashes
- Script content
- DNS records
- External domains
- Certificate changes
- CSP violations
- Unexpected network requests
5. Review WordPress Admin Activity
If your site used an affected Brevo integration during the reported attack window, Sansec recommends reviewing access logs for:
/wp-admin/update.php?action=upload-pluginand:
/wp-admin/plugins.php?action=activateAlso investigate plugins installed or activated on September 14, 2026, and compare the filesystem against the plugins shown in the WordPress admin interface.
A malicious plugin can potentially hide itself from the WordPress dashboard, so checking the filesystem is important.
6. Check for ClickFix Exposure
If a visitor reports seeing a suspicious:
“Verify you are human”
or similar prompt on your website, investigate immediately.
Users who followed instructions to copy and execute a command should treat their device as potentially compromised and perform an appropriate malware/security scan. Sansec specifically recommends urgent antivirus scanning for users who executed such commands.
Important IOC Information
Sansec published hashes for affected Brevo assets, including:
Affected sdk-loader.js versions:
58a5c601c9df7ca2120435588fc39f97712d9b878795f6ee500590099a432308
f67d572d2d30407b3f470904326411450763108980cdad89550fbb221fb06782Affected brevo-conversations.js:
9b62c12bc5c7feb9802f58e6cf75a368690df3c754e37cc64483a92acacf87a5Sansec also documented malicious subdomains and C2 paths associated with the campaign. These indicators should be used alongside the complete Sansec advisory rather than treated as a substitute for a full compromise investigation.
The Bigger Lesson for eCommerce
This incident highlights an important security principle:
Your security boundary is no longer limited to your own server.
If your storefront loads:
Your Store
↓
Third-Party JavaScript
↓
Third-Party CDN
↓
Third-Party Infrastructurethen a compromise somewhere in that chain can potentially reach your customers.
For Magento and Adobe Commerce teams, this means security reviews should include not only:
- Magento core
- Extensions
- Composer dependencies
- Server configuration
- PHP
- Redis
- OpenSearch
- Nginx
- Varnish
but also the browser-side supply chain.
Third-party scripts deserve the same level of scrutiny as third-party PHP modules.
Final Thoughts
The Brevo incident is another reminder that trusted third-party services can become powerful attack vectors when their infrastructure is compromised.
For eCommerce businesses, the goal should not be to eliminate every third-party integration. Instead, organizations should understand exactly what they are loading, where it comes from, what permissions it has, and how changes to those dependencies are detected.
Security monitoring should therefore extend beyond the server and application layer into the entire client-side supply chain.
If you operate a Magento, Adobe Commerce, Shopify, WooCommerce or WordPress store, now is a good time to review your third-party JavaScript integrations and ask:
“What happens if one of the vendors we trust gets compromised?”
That question is becoming increasingly important in modern eCommerce security.
Ref : https://sansec.io/research/brevo-supply-chain-attack