Brevo Supply‑Chain Attack Injects Malicious ClickFix Scripts via Stolen Cloudflare API Key
What Happened — Attackers exfiltrated a long‑lived Cloudflare API key that was hard‑coded in Brevo’s source code. Using the key they created a Cloudflare Worker that rewrote JavaScript assets at the CDN edge for about 5½ hours on 14 Sept 2026, injecting ClickFix scripts into Brevo‑hosted pages and into the widgets customers embed on their own sites. The malicious code displayed a fake Cloudflare verification page and attempted to deliver a WordPress plugin payload to site visitors.
Why It Matters for Trust & Control Assurance
- The incident demonstrates how a single compromised third‑party credential can bypass traditional integrity checks, highlighting the need for continuous monitoring of vendor‑provided assets and evidence of credential hygiene.
- A robust third‑party risk program must capture and audit the lifecycle of external API keys, ensuring they are stored securely, rotated regularly, and that any anomalous edge‑logic changes are flagged in real time.
- Mapping this breach to the control objective of “secure third‑party credential management and supply‑chain oversight” provides audit‑ready evidence across frameworks such as NIST CSF 2.0.
Who Is Affected – SaaS CRM and digital‑marketing platforms, their downstream customers (e‑commerce sites, blogs, corporate portals), and ultimately the visitors to those sites.
Recommended Actions
- Inventory all hard‑coded third‑party credentials; replace them with secret‑management solutions and enforce short‑lived tokens.
- Enable Cloudflare (or equivalent CDN) logging and alerting on Worker creation, route changes, and DNS record modifications.
- Incorporate the credential‑handling control into your continuous assurance dashboard and retain immutable logs for audit readiness.
Technical Notes – Attack vector: compromised third‑party API key → Cloudflare Worker injection → edge‑level script modification. No CVE; the breach leveraged a mis‑managed credential rather than a software flaw. Affected assets: Brevo.com, sendinblue.com, onboarding.brevo.com, sibforms.com, and any customer site embedding Brevo widgets. Source: BleepingComputer