Eine unausgeglichene Darmflora hat gesundheitliche Folgen. Lesen Sie hier, wie sich die Darmflora aufbauen lässt.

Might be worth reading this guide though in the interim Send Emails for Free with Brevo (formerly Sendinblue) Community Guides > This tutorial would show you how to send emails with Brevo (formerly Sendinblue). You can create unlimited emails and send up to 300 emails per day. Brevo (formerly Sendinblue) is an SMTP server that sends email for applications. You can send up to 300 emails/day with Brevo. Even though it says they will add Brevo branding on their site, that is only if you use their email marketing tool and not their SMTP service. Create an account with Brevo (or sign in with google) Go to profile and se…

Brevo, formerly Sendinblue, is the newsletter, sign-up form and chat platform behind a large number of small business and non-profit websites. If your site loads Brevo's tracking code, its chat widget or one of its hosted forms, this concerns you, even if someone else manages the site. **In short, as of 18 September 2026:** on 14 September, between 16:05 and 20:13 UTC, files served by Brevo were altered to load attacker code. On WordPress sites where an administrator was logged in, it tried to install a plugin, most likely a backdoor. Every other visitor was shown a fake "verify you are human" prompt. Brevo is no longer serving the altered files, but a site that was infected during those hours stays infected. ## What happened On 10 September 2026, Brevo publicly disclosed a first incident. An attacker abused a flaw in the way Brevo handled SAML single sign-on and reached **138 customer accounts**. Six of them were used to send phishing emails to the contacts stored there, and 43 had their contact lists exported. Brevo says it closed the route the same morning and signed out every user on the platform. On 16 September, the Dutch security firm **Sansec** published an analysis of a second, much wider event on 14 September. Files that customer sites load directly from Brevo gained one extra line, which pulled in the attacker's script. According to Sansec, the affected files were: * the tracking code loader, **sdk-loader.js** ; * the chat widget, **brevo-conversations.js** ; * Brevo-hosted pages for sign-up and unsubscribe forms, including the ones people reach from the "unsubscribe" link in a newsletter. Sansec estimates that more than **100,000 sites** were exposed. The root cause is not confirmed. Sansec's working hypothesis is that the attackers gained access to Brevo's Cloudflare account, which would explain both the new DNS records and the rewritten responses. At the time of writing, Brevo had not published a statement about the 14 September event. ## Two payloads, two audiences **WordPress administrators.** If an administrator who was logged in to wp-admin opened a public page of their own site during that window, the script used their session to upload and activate a plugin downloaded from the attackers. Sansec did not recover the plugin, but assesses it as likely to be a backdoor: hidden, persistent access to the site. **Everyone else.** Other visitors saw a full-page fake verification. It placed a command on the clipboard and told the visitor to paste it and run it. The technique is called **ClickFix**. It exploits no browser flaw at all. It works only because the person runs the command themselves. Sansec also notes that the script stayed quiet for crawlers, developer tools and automated scanners, which is why a quick look at your own site afterwards proves nothing. ## What to check on a WordPress site If your site used the Brevo tracker, the chat widget or a hosted Brevo form, these are Sansec's recommendations: 1. In the web server access log for 14 September, look for a **POST** to **/wp-admin/update.php?action=upload-plugin** , followed shortly by a **GET** to **/wp-admin/plugins.php?action=activate**. 2. Look for any plugin installed or activated on **14 September 2026**. 3. Compare the plugin directory on disk with the list in the admin screen. A malicious plugin can hide itself from that list, so the list on its own proves nothing. Preserve the logs before rotation removes them: many hosts keep only days or weeks. And do not block the apex domain **sendibt1.com** outright. Sansec points out that the apex is Brevo's legitimate open and click tracking. Only subdomains such as **cdn2.sendibt1.com** were malicious. ## The one rule for staff and customers It applies to every site, not only this one: **no legitimate website asks you to open the Run dialog, a terminal or a command prompt to pass a security check.** Anyone who saw such a prompt during that window and followed it ran a malicious command on their own machine. Sansec's advice is a full antivirus scan, promptly. ## Questions to put to whoever runs your site * Does our site load any Brevo code: the tracker, the chat widget or a hosted form? * Is it WordPress? * Were the access logs for 14 September checked for plugin uploads and activations, and what was found? * Was the plugin directory on disk compared with the admin list? * Have the logs from that day been preserved? Ask for the answers in writing and dated. If something looks wrong, save the logs and a copy of the site files before anyone deletes or reinstalls anything, because those are the evidence of what happened. ## What we cannot tell you We cannot tell you whether your site was affected. We have not checked anyone's site, we do not run security audits and we do not manage WordPress installations. This article collects what the sources say so you know what to ask. The answer for your site lives in its logs and with whoever administers it. ## Sources Sansec, "Brevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malware", 16 September 2026: sansec.io/research/brevo-supply-chain-attack. Brevo, incident write-up of 10 September 2026. Both read on 18 September 2026. If you find a difference from the source, write to us and we will correct the article. _Originally published on devaland.com: The Brevo Supply-Chain Attack: What to Check if Your Site Embeds Brevo_

Depressiv oder „nur“ traurig? Der kostenlose Depressionstest ermöglicht Ihnen eine unkomplizierte Einschätzung. Testen Sie sich jetzt!

Planning to leave Brevo? Use this complete pre-cancellation export checklist to save contacts, campaigns, automations, templates

Herzstolpern kann beängstigend sein, ist aber meist harmlos. Wie sich Herzstolpern äußert und wann ein Arztbesuch ratsam ist, erfahren Sie hier!

Attackers abused Brevo (formerly Sendinblue) to inject malware into up to 100,000 sites at the CDN edge, so origin files never changed and checks missed it.

📰 Source : FrenchBreaches — publié le 18 septembre 2026. L'article rapporte deux incidents de sécurité distincts ayant touché Brevo (anciennement Sendinblue), entreprise française de marketing et CRM basée à Paris. 🔓 Incident principal — 14 septembre 2026 : attaque via clé API Cloudflare Des attaquants ont obtenu une clé API Cloudflare disposant de permissions importantes appartenant à Brevo.

A Brevo supply-chain attack used compromised Cloudflare access to inject malware into websites, potentially affecting over 100,000 sites. Brevo, formerly known as Sendinblue, is a French cloud-based marketing and customer communication platform whose clients include eBay, Louis Vuitton and Michelin. The company was first compromised on September 10, when attackers exploited a vulnerability in its […]

Ce lundi 14 septembre 2026, des pirates ont détourné une clé Cloudflare de Brevo, l'ex-Sendinblue, pour glisser du code malveillant dans des ressources reprises par **plus de 100 000 sites**. C'est le deuxième incident de sécurité en cinq jours pour cette plateforme française d'emailing.

Email marketing and customer relationship management platform Brevo, formerly known as Sendinblue, suffered a supply chain attack in which malicious code was able to reach Brevo's own websites as well as customers' websites utilizing embedded Brevo services.  Researchers at Sansec discovered that the incident was much more extensive than the six accounts previously revealed. When Brevo infrastructure was compromised on September 14, 2026, malicious JavaScript began to be served. In addition, Sansec found evidence that more than 100,000 customer websites utilizing Brevo components may have been exposed as a result of the attack.  There were two main infection paths used in the campaign: a malicious WordPress plugin that targeted site administrators and a ClickFix overlay that was displayed to visitors.  Malicious Code Reached Embedded Brevo Components Brevo-hosted pages as well as JavaScript resources commonly embedded in customer websites were identified as containing the injected code. These included Brevo trackers, Conversations chat widgets, as well as other forms hosted on Brevo servers.  Modified versions of the JavaScript assets directed browsers to infrastructure controlled by attackers, which served the malicious malware loader. Sansec identified several malicious subdomains under the Brevo domain sendibt1.com. A number of hostnames were affected, including cdn.sendibt1.com, cdn2.sendibt1.com, cdn3.sendibt1.com, cdn4.sendibt1.com, cdn9.sendibt1.com, cdn10.sendibt1.com, and cdn11.sendibt1.com.  A SSL certificate for cdn.sendibt1.com was also discovered on August 25, which indicates that the attackers had gained access to Brevo's DNS records. A malicious content display was observed on September 14 from approximately 16:05 until 20:13 UTC, which was observed by researchers.  A total of 2,549 breaches of Content Security Policy were reported across 12 sites during and after the attack window. These hosts stopped resolving on September 15, while the affected files were reported clean at the site of origin.  ClickFix Campaign Targeted Website Visitors Injected malware delivered different payloads depending on the visitor. When a visitor was detected as a WordPress administrator, it attempted to install a plugin from a Brevo subdomain controlled by the attacker. A fake verification prompt was displayed using the ClickFix technique to visitors, instructing them to copy a command and execute it under the pretext of demonstrating their humanity. According to Sansec, the malware did not activate for crawlers, developers, or automated scanners, therefore preventing it from being detected during routine inspections.  WordPress Sites Faced a Deeper Threat  A more significant risk was posed to WordPress administrators by the attack. When the compromised Brevo script identified an administrator already logged into a WordPress site, it attempted to download and install plugins from attacker-controlled infrastructure.  BleepingComputer examined a copy of the plugin, which was disguised as Web Media Optimizer, but was actually a JavaScript loader and persistent backdoor. Installing this plugin allowed it to hide from the normal WordPress plugin list and copy itself into the must-use plugins directory, making its removal more difficult. Additionally, the plugin contacted attacker-controlled infrastructure to obtain additional JavaScript, allowing malicious content to continue loading even if the remote server was unavailable, as researchers discovered.  A critical feature of the plugin was that it contained a hardcoded authentication mechanism capable of creating a valid administrator session without requiring the legitimate administrator password. This allowed attackers to continue access to a compromised WordPress installation beyond Brevo's original exposure period.  Brevo Took Down the Malicious Infrastructure After detecting the intrusion, Brevo removed the malicious Cloudflare Worker and associated routes. As a result of the compromise, Brevo revoked its API key and credentials, removed attacker-controlled hostnames and purified edge caches. Additionally, the hardcoded Cloudflare credential was removed from the source code of the company.  Sansec reports that malicious hosts began to cease resolving on September 15 and Brevo's affected files were restored to their original versions. Although the delivery window ended, the malware was not removed from WordPress sites where the rogue plugin had already been installed. Additionally, Brevo SSO security incident reported on September 10 also occurred following the incident. It was reported that six customer accounts were accessed unauthorised and were used for phishing, as well as contact data exported from 43 other accounts in that incident.  A public connection has not been established between Brevo's earlier incident and Cloudflare's subsequent compromise. The Brevo incident illustrates the threat of third-party services that extend beyond the infrastructure of the provider and affect websites which utilize embedded scripts. Additionally, the combination of ClickFix lures and persistent WordPress backdoors creates a higher risk for website administrators and visitors alike.

What happened in the Brevo supply chain attack In early 2024 security researchers discovered that threat actors had gained access to a Brevo (formerly Sendinblue) API key. Using that credential they deployed a Cloudflare worker that silently altered the HTML of thousands of websites that relied on Brevo services.

L'analyse est publiée le 16 septembre 2026 par la Sansec Forensics Team sur la base d'investigations forensiques menées après un incident de sécurité initialement divulgué par Brevo (anciennement Sendinblue) le 10 septembre 2026. Brevo avait alors signalé la compromission de 6 comptes clients ; Sansec révèle une attaque d'ampleur bien supérieure.

Masern, Grippe oder Hepatitis: Welche Impfungen sind wichtig? Wann muss ich sie auffrischen? Welche Impfungen brauchen Kinder und Schwangere?

Brevo, la plateforme française de marketing numérique anciennement connue sous le nom de Sendinblue, a été victime d’un incident de sécurité ayant permis

Compare Zoho Marketing Plus vs Brevo on pricing, email send limits, automation, social media, SMS, analytics, channels to find the right platform