BREVO SUPPLY-CHAIN ATTACK SPREADS MALWARE TO CUSTOMER SITES

The email marketing platform disclosed that threat actors gained access to a Cloudflare API key, which they leveraged to inject ClickFix malware scripts. The injections targeted both Brevo's own web properties and JavaScript code embedded on customer websites. ClickFix is a known malware distribution technique that uses fake browser update prompts to trick users into downloading malicious software. By compromising Brevo's API key, attackers could inject scripts at scale across the company's infrastructure and client implementations. Brevo has not disclosed the full scope of affected customers or the duration of the attack. The company reportedly worked to revoke the compromised credentials and remove malicious code. This incident underscores supply-chain vulnerabilities where compromises at service providers can cascade to affect downstream customers. API key management and access controls remain critical security measures for preventing similar attacks.