Attackers compromised Brevo's supply chain by stealing a Cloudflare API key, which allowed them to inject malicious ClickFix scripts into Brevo's own websites and JavaScript files that are embedded on customer websites. This supply-chain compromise enabled the distribution of malware through trusted Brevo-hosted resources, potentially impacting visitors to customer sites that load these scripts.

Malicious scripts were injected into Brevo's websites and customer-embedded JavaScript files, leading to malware distribution. This compromises the integrity of Brevo's supply chain and exposes customers and their visitors to malware infections. The attack undermines trust in Brevo's software delivery and could lead to further downstream compromises.

No specific patch or remediation details are provided. Since this is a supply-chain compromise involving stolen API keys, remediation would typically involve revoking and rotating compromised API keys, auditing and cleaning affected scripts, and enhancing security controls around API key management. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.