NewsPublished 17 Sep 2026

Brevo supply-chain attack injected ClickFix scripts on customer sites

Source Bleeping Computer

Description

Brevo experienced a supply-chain attack where attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into Brevo's websites and JavaScript files embedded on customer sites. This injection was used to distribute malware to visitors of affected sites.

Impact

Malicious scripts were injected into Brevo's websites and customer-embedded JavaScript files, leading to malware distribution. This compromises the integrity of Brevo's supply chain and exposes customers and their visitors to malware infections. The attack undermines trust in Brevo's software delivery and could lead to further downstream compromises.

Defensive guidance

Since this is a supply-chain compromise involving stolen API keys, remediation would typically involve revoking and rotating compromised API keys, auditing and cleaning affected scripts, and enhancing security controls around API key management.

References

bleepingcomputer.com/news/security/brevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 17 Sep 2026, 17:46 UTC

References

Community reviews

Related threats