Brevo Supply-Chain Breach: Stolen Cloudflare API Key Used to Inject ClickFix Malware Scripts

What Happened

Brevo (formerly Sendinblue) has confirmed that attackers stole a Cloudflare API key and used it to inject malicious "ClickFix" scripts into Brevo's own websites as well as JavaScript files that are embedded on customer sites, according to BleepingComputer. ClickFix is a social-engineering technique that tricks visitors into copy-pasting and running attacker-supplied commands (often framed as a "fix" for a fake error or CAPTCHA), typically leading to malware execution. Details on the scope, timeline, and specific payloads remain limited at this stage.

Why It Matters

Because the compromise reached JavaScript embedded on customer sites, this is a supply-chain incident: organizations that never had a direct relationship with the attackers could still have served malicious code to their own visitors simply by including Brevo's script. A stolen Cloudflare API key as the initial access vector also underscores how much trust is placed in third-party CDN/edge tooling — compromise of a single credential can propagate malicious content across many downstream properties simultaneously.

What Defenders Should Watch For

• Inventory any use of Brevo (Sendinblue) embed scripts, forms, or tracking snippets on your web properties and monitor for unexpected changes to their content or hashes (e.g., subresource integrity checks, script diffing).
• Hunt for ClickFix-style social engineering on your own sites and in phishing telemetry: prompts urging users to open Run dialogs, PowerShell, or terminal windows and paste commands to "fix" an error.
• Review Cloudflare (and other CDN/DNS provider) API key scope and rotation policies; ensure keys are least-privilege and monitor API key usage logs for anomalous configuration changes.
• Alert on outbound clipboard-to-shell execution patterns (e.g., PowerShell or cmd processes spawned shortly after clipboard paste events) as a general ClickFix detection angle.
• Check web proxy/EDR logs for connections to known ClickFix delivery infrastructure once IOCs are published.

Developing Story

This is a net-new, still-developing incident with limited public detail beyond Brevo's confirmation of the breach and its supply-chain impact. We will update this analysis as more information — including scope, affected customer count, and specific malware families — becomes available. Read the original reporting at BleepingComputer.