Brevo Supply-Chain Attack Compromises Customer Sites via Stolen Cloudflare API Key

In September 2026, Brevo (formerly Sendinblue) confirmed that attackers gained access to a Cloudflare API key and used it to modify DNS/CDN settings or page rules. This allowed the injection of malicious ClickFix scripts into Brevo's websites and JavaScript files embedded on customer sites. ClickFix scripts typically mimic legitimate user interface interactions, such as fake CAPTCHA updates or system alerts, to trick visitors into executing commands that distribute malware. The compromise affects the global customer base of Brevo, with customers' websites unknowingly serving the malicious scripts to their own visitors. Brevo has confirmed the incident and is working with affected customers to mitigate the impact. Cloudflare has been notified and is reviewing the use of the compromised API key. The exact number of affected customers and the specific malware families distributed remain under investigation.

The attack underscores the growing threat of supply-chain compromises targeting CDN and DNS infrastructure. By stealing a Cloudflare API key, the threat actors were able to exert significant control over web traffic routing and page modifications, enabling the injection of malware at scale across multiple customer domains.