confirmedhighSupply chainFirst reported Sep 17, 2026
Brevo: supply-chain attack injected ClickFix scripts on customer sites
Brevo confirmed attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its websites and JavaScript files embedded on customer sites. The injected scripts were used to distribute malware.
Members only
The full record: the timeline and 1 linked report
- Every update as it happened, with the status at each step
- Every report behind the record, newest first
- Alerts the moment Brevo — or anything else you track — is hit again
A free account is all it takes — no card, one minute.