Brevo breach: Stolen Cloudflare key used to push ClickFix malware to client websites

Attackers stole a long-lived Cloudflare API key from Brevo and used it to create a malicious Worker that altered content at the CDN edge for about five and a half hours on September 14. The injected scripts displayed fake Cloudflare verification pages and ClickFix instructions, potentially affecting up to 100,000 customer websites. Brevo stated that its core app, API, email delivery, and customer data were not compromised, and the malicious worker has been removed.

The attack window was roughly five and a half hours on September 14, between 16:07 and 20:30 UTC. The stolen API key, hardcoded in source code, granted full account permissions, allowing the attacker to create Workers and routes without triggering alerts. Because the malicious Worker modified responses at the CDN edge and stripped security headers like Content-Security-Policy, the origin files remained untouched, bypassing standard integrity checks.

The injected scripts targeted Brevo's forms script, Conversations widget, and SDK loader. On WordPress sites, the script checked for admin login and attempted to upload a malicious plugin disguised as "Web Media Optimizer." This plugin hid itself from the plugin list, copied itself to the must-use plugins directory for persistence, and contacted a remote server for further instructions, even storing a backup JavaScript URL.