Brevo supply-chain attack injected ClickFix scripts on customer sites

Attackers compromised Brevo's infrastructure by stealing a Cloudflare API key, which granted them the ability to deploy a malicious Worker that silently modified JavaScript delivered to customer websites at the CDN edge — without touching Brevo's origin servers directly. This attack vector is particularly dangerous because CDN-level tampering can affect thousands of downstream customers simultaneously, and the modifications are often invisible to traditional endpoint or server-side monitoring. The five-and-a-half-hour window of exposure highlights how quickly a single compromised credential can cascade into a widespread supply-chain event. This matters because customers implicitly trust scripts served from vendors they embed on their sites, making CDN-injected malware extremely effective at bypassing end-user defenses.