The campaign appears to have targeted visitors via Brevo's embedded tracker, chat widget, hosted forms, and unsubscribe pages. The incident seems larger than Brevo's September 10 disclosure, which stated that six customer accounts were compromised. Four days later, malicious code was reportedly served from Brevo-linked domains between 16:05 and 20:13 UTC on September 14.
SEO keyphrase synonyms include Brevo CDN JavaScript injection, Brevo DNS abuse attack, malicious website script injection, CDN supply-chain attack, customer website compromise, and third-party JavaScript attack. Brevo CDN JavaScript Injection Sansec discovered an injected script loading malware from attacker-controlled subdomains under sendibt1.com, a legitimate Brevo email-tracking domain.
If it detected a user was logged in as a WordPress administrator, it attempted to install a WordPress plugin through the victim's existing admin session. WordPress administrators should examine access logs for any suspicious requests to `/wp-admin/update.php?action=upload-plugin` and `/wp-admin/plugins.php?action=activate` on September 14. Website owners should refrain from blocking the apex sendibt1.com domain, as it is used for legitimate Brevo email tracking and blocking it could disrupt campaign analytics, according to Sansec.
Here are the indicators of compromise (IOCs): - **Compromised JavaScript https://cdn.brevo.com/js/sdk-loader.js**: Brevo SDK loader observed with an injected line that loaded attacker-controlled f.js malware. Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort.
