Inside the Marketing Script That Served Malware to 100,000 Sites

Editor’s Note

Hi, two breaches this month where every security tool in the building saw nothing, because the attack came through something nobody had thought to test. If your security programme starts and ends with a scanner and a pentest scoped to "what we built", September is a good month to rethink.

Lavanya Chandrasekharan,
Siemba

TLDR

• Brevo, an email marketing tool used by 500,000+ businesses, served malware from its own website for five and a half hours on 14 September. Over 100,000 customer sites were in the blast radius. Their own checks saw nothing.
  
  
• An attacker spent seventeen months reading data out of company portals built on Salesforce and ServiceNow. No hacking. The data was just sitting there, visible to anyone who asked.
  
  
• A new browser attack, BragJack, lets a malicious extension take over the AI assistant in Chrome, Edge, Opera, Perplexity Comet and Claude in Chrome, using permissions an ad blocker already has. Patched, but worth knowing.

The Marketing Tool That Served Malware

Brevo is an email marketing and CRM platform used by eBay, Louis Vuitton, Michelin and over 500,000 other businesses. Its scripts handle contact forms, chat widgets and email signups on customer websites around the world.

On 14 September, those scripts served malware to visitors for five and a half hours.

Here is how it happened. Attackers found an API key, basically a password with full admin access to Brevo's infrastructure, sitting hardcoded in Brevo's own source code. They used it to intercept traffic flowing through Brevo's servers and quietly swap in their own code. The malware never touched Brevo's original files. So nothing triggered an alert.

Visitors to affected sites saw a fake "verify you are human" page with a command to run in their terminal. WordPress admins got something worse: a silent plugin installed in the background that could hand attackers permanent access to the site, one that hides itself from the plugin list.

More than 100,000 sites were included in the blast radius. Brevo confirmed the incident and has since fixed it.

The lesson here is not really about Brevo. It is about the scripts your marketing team added to your website years ago from tools you probably still use and have never thought twice about. If one of those vendors is compromised, the attack lands directly on your customers, from a domain your monitoring trusts completely.

The question worth asking,

“Do you know which third-party scripts are running on your public sites right now, who owns each one, and what happens to your customers if that vendor has a bad day?”

If you do not have that list, this is a good place to start.

The Portal That Just Handed Over the Data

Salesforce and ServiceNow are platforms many companies use to manage customers and internal operations. Companies often build public-facing portals on top of them, customer self-service sites, partner portals, support pages.

These portals have a built-in guest account for visitors who are not logged in. If that account has more access than it needs, anyone on the internet can read that data.

In August, researchers uncovered an attacker who had been doing exactly this for seventeen months. Just one server, one IP address that never rotated. The busiest target logged over 560,000 requests from it.

This is the kind of thing a standard security scan will not find, because the platform is working exactly as it was configured. A human tester who logs out and tries to pull data is what finds it.

Salesforce has published guidance on how to fix guest account permissions. The problem is rarely that companies do not know how to fix it. It is that nobody knew it needed fixing

One to Watch: AI Assistants and Browser Extensions

On 16 September, security researcher Gal Weizman published BragJack, finding that one malicious browser extension can take over the AI assistant built into Chrome, Edge, Opera, Perplexity Comet and Claude in Chrome, using only the permissions a standard ad blocker already has.

Once installed, it works without the user doing anything. It can read local files, take screenshots and act on the user's behalf.

Both vulnerabilities have been patched by the browser vendors. But the bigger question this raises is whether you know what extensions your employees have installed, and whether any of them have "read and change all your data on all websites" approved without anyone thinking twice.

What This Means for You

All three incidents share one thing, the attack came through something that was approved, not something that was broken into.

A third-party script from a vendor you trust. A permission on a portal nobody reviewed. An extension someone installed to get something done.

None of these show up in a CVE feed. None of them get flagged by a scanner. And none of them are in a standard pentest scope, because they were not built by your team.

This is the scoping problem.

Most security programmes are designed to test what the company built. The things that actually get used to attack companies in 2026 are increasingly the things around it, the vendors, the platforms, the integrations, the credentials nobody owns.

Three Things to Do This Month

• List every third-party script on your public sites and name an owner for each. Every external script is a vendor with write access to your visitors' browsers. Get the list, assign an owner, and remove what nobody can justify. If you use Brevo, check your access logs for 14 September.

   

• Log out of your customer portals and see what a stranger can access. Open your Salesforce or ServiceNow portal in a private browser window and try to pull data. What you can see logged out is what an attacker sees. If the answer surprises you, that is the finding.

   

• Give every API key and credential an owner and an expiry date. Brevo's key had full admin access and no expiry. Scan your repositories for credentials, scope them down to what they actually need, and set them to expire.