Brevo Supply Chain Attack Infects Over 100,000 Websites with ClickFix Malware

• •Brevo's supply chain attack affected over 100,000 websites.
• •Attackers exploited a compromised Cloudflare API key to inject malware.
• •Visitors were tricked into executing commands that installed malware on their systems.

On September 14, 2026, Brevo, a marketing platform, suffered a supply chain attack that injected malicious scripts into over 100,000 websites. The attackers exploited a compromised Cloudflare API key to deploy a Cloudflare Worker, which modified content at the CDN edge for approximately five and a half hours. Visitors to affected sites were shown a fake verification page prompting them to execute commands that would install malware on their Windows computers. Additionally, logged-in WordPress administrators were targeted with a malicious plugin that could create a backdoor. The attack was confirmed by Brevo and cybersecurity firm Sansec, which reported that the malicious activity was active from 16:05 to 20:13 UTC. Brevo has since revoked the compromised API key and cleaned affected files. The incident highlights the risks associated with supply chain vulnerabilities and the effectiveness of ClickFix-style attacks. Brevo's client list includes major brands like eBay and Louis Vuitton, amplifying the potential impact of the breach.