Brevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malware

Reported 17 Sep 2026 by otx · Severity: medium

A significant supply chain attack compromised Brevo's infrastructure on September 14, 2026, affecting over 100,000 customer websites. Attackers injected malicious code into Brevo's JavaScript assets and widgets, delivering two distinct payloads: a WordPress plugin backdoor automa