Malicious ClickFix Code Was Reportedly Served Through Brevo Customer Scripts

A stolen API key used to alter delivered content

Brevo says attackers obtained a long-lived Cloudflare API key embedded in its application source code. According to the company, they used it to create a Cloudflare Worker that modified content at the CDN edge, affecting Brevo web pages and JavaScript components customers embed on their own sites. Visitors were reportedly shown a fake Cloudflare verification page that used ClickFix instructions—social-engineering prompts designed to persuade someone to run a command on Windows. Brevo says it removed the worker, revoked the compromised key and related credentials, and purged edge caches. A security firm estimated that up to 100,000 websites using affected components may have been affected.

Before the reported compromise, Brevo's customer-embedded scripts and web content were not being altered by the malicious Cloudflare Worker described by the company.

Brevo says an attacker-created Cloudflare Worker rewrote content at the CDN edge, adding malicious ClickFix scripts to Brevo sites and scripts used on customer websites.

The reported compromise would have turned a shared third-party web component into a distribution path affecting sites that embedded it, while leaving Brevo's origin files unchanged, according to the company.