Brevo ClickFix Attack: Stolen Cloudflare API Key

Thu Sep 17

On September 14, 2026, attackers turned Brevo's own Cloudflare edge into a malware delivery network. For roughly five and a half hours they served a fake "Cloudflare, verify you are human" ClickFix lure on Brevo properties and on JavaScript that customers embed across the web. Brevo's post-mortem pins the root cause on a long-lived Cloudflare API key that had been hardcoded in application source with full account permissions.

This Brevo ClickFix incident is distinct from the September 10 Brevo SAML SSO compromise that fueled account takeovers and phishing. Different day, different mechanism, overlapping brand headache. Sansec estimated exposure on the order of 100,000 sites that load the affected Brevo components. Origin files on Brevo's servers were never rewritten — the Worker mutated responses in transit and stripped Content-Security-Policy so browsers would accept the injection.

Canonical record: Brevo Cloudflare ClickFix 2026. What follows is the technical timeline from Brevo's write-up, independent researcher detail on KongTuke loaders, what was and was not affected, and what site owners should check.

What happened

Brevo's status-page post-mortem describes a resolved incident with an impact window of 15:01–20:30 UTC on 14 September 2026 — five hours and twenty-nine minutes. An attacker used a compromised Brevo Cloudflare API key to deploy a Cloudflare Worker on Brevo's account. That Worker injected malicious script into pages on brevo.com and sibforms.com and into three JavaScript files customers embed on their own websites.

Selected visitors saw a full-screen Cloudflare-branded page, sometimes after a genuine Cloudflare checkbox, instructing them to press Win+R, then Ctrl+V, then Enter. Those steps paste a clipboard command into the Windows Run dialog and download malware. The lure was selective: most visitors and repeat visits saw nothing.

On WordPress sites embedding a Brevo widget, if the visitor was logged in as a WordPress administrator, later script variants also tried to silently install and activate a malicious plugin.

BleepingComputer and researchers at ADAMnetworks independently documented the same ClickFix pattern and tied the loader behavior to the KongTuke family.

How the attack worked

Stolen Cloudflare API key

Root cause, in Brevo's words: a long-lived Cloudflare API key with full account permissions was stored in application source code and obtained by the attacker. With that key they could create Workers, routes, and DNS records on Brevo's zones without triggering an alert.

Investigation indicates the key was first misused in late August 2026. Brevo found no injection of malicious content into customer-facing pages before 14 September. Availability of the key weeks earlier did not, on current evidence, mean weeks of public ClickFix.

Because the Worker rewrote responses at the CDN edge and removed security headers such as Content-Security-Policy, origin servers and files remained unmodified. Standard integrity checks that hash files on disk therefore saw nothing wrong. That is the uncomfortable lesson of this Brevo supply chain attack: your deploy pipeline can be clean while every browser still receives poison.

Edge rewrite, not source compromise

Brevo emphasizes that app.brevo.com was not affected, no Brevo systems were modified at their source, and content was altered in transit at the CDN edge. The Conversations widget, SDK, and forms were "never modified at their source" and were declared safe to use again after cleanup — the malice lived in the edge Worker and attacker hostnames, not in Brevo's git history.

ClickFix loader and KongTuke

ADAMnetworks recovered loaders served from multiple sendibt1.com CDN hostnames under a domain Brevo lists among its technical domains. Captured JavaScript matched KongTuke construction details: fake verification panels, clipboard command delivery, visitor fingerprinting, and challenge-response gating. KongTuke (also tracked in overlapping reporting as LandUpdate808 / TAG-124 activity) has used compromised sites for malware delivery since 2024 and shifted heavily into fake CAPTCHA prompts.

Researchers observed Brevo SDK and Sibforms main.js responses that kept their full clean bodies and gained roughly 173–174 bytes at the end — enough to create a script element pointing at /f.js on attacker-chosen loader hosts. Hosted form and unsubscribe HTML carried a script tag near </head> instead. Certificate Transparency showed certificates for some loader names minted minutes after delivery began on September 14; by September 15 the loader names returned NXDOMAIN.

BleepingComputer separately confirmed a WordPress plugin archive marketed as "Web Media Optimizer" that behaved as a persistent backdoor and JavaScript loader, with related infrastructure observed on additional attacker domains. Later KongTuke-style samples attempted WordPress admin plugin upload via stolen nonces; ADAMnetworks noted at least one shipped routine that failed before upload completed because of a JavaScript reference error — broken does not mean harmless for every variant.

Timeline (14 September 2026, UTC)

Brevo's published timeline:

14:23 — Attacker creates the first hostname used to serve the script on a Brevo-owned domain.
14:28 — Worker deployed and tested on low-traffic Brevo domains.
14:42 — Worker routed to brevo.com.
15:01 — Worker routed to all of brevo.com; impact begins.
16:07 — Worker updated to append a loader to the three embedded JavaScript files and routed to sibforms.com. ClickFix active on the listed URLs from this point until 20:30.
19:33 — Security incident opened; investigation begins.
20:30 — Malicious Worker and routes removed; compromised API key and credentials created with it revoked; injection stops.
20:42 — Independent verification confirms affected pages and scripts are clean.
Following hours — Attacker hostnames deleted; edge caches purged.
15 September — Customer notification begins.

Sansec's earlier public window (~16:05–20:13 UTC) aligns with the ClickFix-on-embeds phase. Brevo's broader edge impact clock starts at 15:01 when the Worker covered all of brevo.com.

What was affected

Surfaces Brevo lists as impacted:

brevo.com and sendinblue.com
login, account, my, and onboarding hosts under brevo.com
sibforms.com and the Brevo forms script
Brevo Conversations widget and Brevo SDK loader embeds on customer sites

That last bullet is why this reads as a supply-chain event rather than a simple defacement. Marketing sites, Shopify storefronts with Brevo/PushOwl trackers, hosted signup forms, and unsubscribe pages could all fetch rewritten JavaScript from Brevo infrastructure. Public browser captures logged during the window spanned dozens of page domains, including Brevo's own marketing site and third-party storefronts.

Sansec's roughly 100,000-site exposure estimate reflects how widely those embeds are deployed — not a confirmed malware-execution count. Most visitors never saw the lure because delivery was selective.

What was not affected

Per Brevo:

app.brevo.com
The Brevo API
Email sending / delivery infrastructure
Customer account data held in Brevo

To be clear: this write-up is not claiming Brevo's CRM database was exfiltrated in the ClickFix window. The September 10 SAML SSO incident is a separate event that did involve account hijack and outbound phishing — including high-profile follow-on abuse reported against Trezor users in trade press. Brevo did not publicly confirm to BleepingComputer whether the SSO theft and the Cloudflare key theft were connected operations.

Who is at risk

Windows visitors who followed the Win+R / Ctrl+V / Enter ritual on an affected page during the window. Treat that machine as compromised until cleaned.
WordPress administrators who browsed a site embedding Brevo scripts while logged into wp-admin on September 14. Check for unexpected plugins installed or activated that day — including anything resembling "Web Media Optimizer."
Brevo customers whose public sites load Conversations, forms, or the SDK loader. Even if your marketing team never touched Cloudflare, your visitors may have fetched poisoned edge responses.
People who logged in via brevo.com (not app.brevo.com) on September 14. Brevo asks them to change passwords and review API keys as a precaution.
Email recipients who clicked tracking or unsubscribe links that resolved onto sibforms pages during the window — researchers captured loader activity on those routes too.

Campaign context

ClickFix works because it outsources code execution to the victim. No drive-by exploit kit required — just trust in a Cloudflare-looking interstitial and muscle memory for Run dialogs. KongTuke operators have industrialised that social engineering across hacked CMS sites; hijacking a major ESP's CDN account simply scaled the same lure through legitimate embed channels.

Hardcoded cloud API keys with god-mode permissions remain a recurring failure mode. Full-account Cloudflare tokens in source control turn any code leak, CI secret scrape, or developer laptop theft into the ability to mint Workers and DNS under the victim's brand. Brevo's remediation path — Vault, short-lived narrowly scoped tokens, audit alerts on Worker/DNS/member changes, log streaming, and integrity checks for embedded assets — is the checklist every SaaS vendor with customer-side JavaScript should already be running.

The Brevo Cloudflare API key incident also collides with another 2026 Brevo headache: the SSO phishing wave days earlier. Defenders reading status pages should not collapse the two into one narrative without evidence, but customers experiencing both in the same week have every reason to rotate credentials broadly and review outbound campaigns for unauthorized sends tied to the earlier event.

What Brevo did

Immediate actions Brevo lists:

Removed the malicious Worker, its routes, and attacker-created hostnames
Revoked the compromised key and credentials created with it; reviewed every credential and member on the Cloudflare account
Purged edge caches and verified clean content on affected pages and scripts
Removed the hardcoded credential from source and replaced it with narrowly scoped, short-lived tokens

Longer hardening: HashiCorp Vault as the store for Cloudflare keys with automatic rotation; alerting on Cloudflare audit events that change Workers, routes, DNS, or account access; Cloudflare logs streamed into security monitoring; integrity protection for versioned embedded assets where possible; regular external scanning; review of third-party edge configurations across Brevo domains.

What you should do

If you pasted and ran the command: disconnect the PC from the network, run a full antivirus / EDR scan from trusted media, and rotate passwords used on that machine — starting with Brevo, email, and banking.
WordPress admins: on any site that loads Brevo scripts, review plugins installed or activated on 14 September 2026. Remove unknowns, check must-use plugin directories for persistence drops, rotate administrator passwords, and review users for unexpected admins.
Brevo login via marketing domains: if you authenticated through brevo.com that day, change your password and inventory API keys and connected integrations.
Site owners: confirm Conversations, SDK loader, and forms now hash-match known-clean sizes or vendor advisories; purge any intermediate CDN/cache in front of those scripts; consider Subresource Integrity where Brevo provides versioned digests.
Security teams: hunt proxy logs for sendibt1.com loader hosts and for Win+R ClickFix referrers on September 14; treat hits as likely social-engineering success attempts.
Do not confuse incidents: review the separate September 10 SSO write for unauthorized campaigns and locked accounts even if your embeds were clean during the ClickFix window.
Vendors shipping third-party JS: kill long-lived cloud API keys in repositories; alert on edge Worker creation; monitor CSP stripping; assume attackers prefer rewriting your CDN over owning your origin.

Distinct from the September 10 SAML SSO incident

Four days earlier, Brevo disclosed a separate SAML SSO-related incident in which attackers hijacked customer accounts and launched phishing. Trade press later covered follow-on campaigns, including reporting that Trezor warned hundreds of thousands of users about phishing after Brevo-related exposure. That event is not this Cloudflare Worker story.

Collapsing both into a single "Brevo was hacked" headline hides the operational difference. SSO abuse targets mailbox and campaign trust. The Brevo Cloudflare API key theft targets every browser that loads Brevo's edge-hosted JavaScript. Customers cleaning up after September 10 still needed a separate checklist for September 14 embeds. Brevo did not publicly confirm to reporters whether the two compromises shared an operator.

What visitors actually saw

Brevo describes a full-screen Cloudflare-branded page asking the visitor to press Win+R, then Ctrl+V, then Enter. Following those steps ran a command the script had placed on the clipboard, downloading malware onto Windows. The page sometimes appeared right after a genuine Cloudflare checkbox, which is why even careful users hesitated — the first challenge looked real.

Delivery was selective. Fingerprinting and server-side decisions meant automation, certain locales, or repeat visitors might receive a quiet redirect instead of the panel. That selectivity complicates forensics: absence of a screenshot in your SOC channel does not prove your traffic never hit a loader host during the window.

ADAMnetworks documented public reports from Shopify operators and from researchers who captured the lure on brevo.com itself during the afternoon and evening of September 14. Loader hosts under sendibt1.com appeared in URLScan transactions requested by Brevo tracker and Sibforms scripts. Those captures are why this Brevo supply chain attack is evidenced beyond the company's own status page.

Embedded scripts: the customer-site blast radius

Three categories of customer-side JavaScript mattered once the Worker began appending loaders at 16:07 UTC: the Brevo forms script, the Conversations widget, and the SDK loader. Any site that copied Brevo's install snippet — marketing pages, ecommerce themes, support chat — became a potential distribution point without the site owner deploying a malicious commit.

That is classic third-party script risk with a twist. The vendor's origin stayed clean; the CDN account did not. Subresource Integrity would have helped only if customers pinned hashes of the clean bytes and browsers rejected the 173-byte append. Most marketing installs do not pin. CSP on customer sites might have blocked the loader host — unless, like Brevo's own edge responses, something stripped or never set those headers.

Sansec's estimate of around 100,000 potentially exposed sites is an upper-bound exposure of the embed footprint during the malicious window, not a count of machines that ran malware. Still, for a five-hour event, that reach explains why ClickFix researchers treated Brevo as a high-signal delivery channel rather than a single defaced homepage.

WordPress administrator pivot

Brevo warns that on WordPress sites loading Brevo scripts, a logged-in administrator visit could trigger an attempt to install and activate a plugin. BleepingComputer analyzed a "Web Media Optimizer" archive that hides from the plugin list, persists via must-use plugins, phones home for further JavaScript, and contains a hardcoded authentication key capable of minting administrator sessions without the password.

Even if some KongTuke pivot routines shipped with bugs, other builds and mirrors circulated the same day. Administrators who were logged into wp-admin while browsing an affected front-end on September 14 should treat plugin inventory and user tables as untrusted until reviewed. Changing the admin password after removing a backdoor is mandatory; skipping the must-use directory check is how reinfection happens.

Hardening lessons from Brevo's own roadmap

Brevo's forward-looking controls read like an after-action template other SaaS vendors can steal:

Vault (or equivalent) as the only store for cloud API keys, with rotation and no credentials in source or config files
Human-reviewed alerts on every audit event that changes Workers, routes, DNS, or account membership
Streaming Cloudflare logs into the security monitoring stack
Integrity protection for versioned embedded assets and regular external scanning for injected content
Review of third-party edge configurations across all corporate domains

None of those controls are exotic. The Brevo ClickFix case shows what happens when a full-permission key lives in application source long enough for someone else to hold it by late August and cash it in on September 14.

Canonical record and sources

Indexed at https://breachhistory.com/brevo/brevo-cloudflare-clickfix2026. Authoritative references:

The Brevo ClickFix attack lasted hours, not weeks, but it rode trusted marketing JavaScript onto customer origin pages worldwide. A stolen Cloudflare API key was enough. If your stack embeds Brevo — or any ESP's tracker — the September 14 window is a concrete reason to verify what your visitors actually downloaded from the edge that afternoon.

Keep the two September Brevo incidents mentally separate when you brief executives: SSO phishing abused account takeover; ClickFix abused CDN trust. Both demand credential rotation. Only one demands WordPress plugin archaeology and endpoint malware triage for visitors who obeyed a fake human-verification prompt.

For ongoing updates, start from Brevo's incident write-up and the BreachHistory canonical page rather than screenshots circulating without timestamps. The Worker is gone, the key is revoked, and the embeds are reported clean — but machines that ran the pasted command are still the defender's problem, not Brevo's CDN problem.