Brevo CDN compromise injected ClickFix malware into customer-embedded scripts
The vendor published its post-mortem on 17 September and reporting puts the blast radius above 100,000 customer websites, so any organisation embedding Brevo scripts must find and remediate visitors and staff who executed ClickFix commands before those footholds are sold on this week.
Brevo's post-mortem confirms attackers stole a Cloudflare API key and used it to deploy a malicious Cloudflare Worker that rewrote content at the CDN edge for roughly five and a half hours on 14 September 2026. The Worker altered pages on brevo.com, sendinblue.com, onboarding/login/account/my subdomains and sibforms.com, and — critically — the Brevo forms script, Brevo Conversations widget and Brevo SDK loader that customers embed on their own websites, serving ClickFix social-engineering prompts that lead visitors to run malware-installing commands.
Affected: Brevo forms script (sibforms.com embed) — 14 September 2026, ~5.5-hour window; Brevo Conversations widget script; Brevo SDK loader script; brevo.com pages; sendinblue.com pages; login.brevo.com / account.brevo.com / my.brevo.com / onboarding.brevo.com
How to Test
Grep your site templates, tag manager and CMS plugins for Brevo/Sendinblue script tags (sibforms.com, sibautomation.com, brevo.com SDK loader, Conversations widget) to confirm exposure; then search proxy, CDN and browser-error logs for requests to those hosts during 14 September 2026 and hunt endpoints for ClickFix execution artefacts — Windows RunMRU registry entries, clipboard-launched powershell.exe/mshta.exe/curl spawned from explorer.exe, and unexpected scheduled tasks or Run-key persistence created that day on machines whose users visited an affected site.
How to Mitigate
Nothing in your own code needs patching — the injection happened at Brevo's CDN edge and has been reverted — so remediation is to verify the currently served Brevo scripts match known-good hashes, pin them with Subresource Integrity or self-host where the vendor supports it, tighten script-src in your Content Security Policy, and reimage plus rotate credentials, browser sessions and MFA for every endpoint that ran a ClickFix command.