GoKawiilBrevo breach used stolen Cloudflare API key to push ClickFix malware to sites
Brevo disclosed that hackers obtained a hardcoded, full-permission Cloudflare API key and used it to deploy a rogue Cloudflare Worker that rewrote content at the CDN edge for roughly 5.5 hours on September 14. The tampered scripts, including Brevo's forms widget, Conversations tool and SDK loader embedded on customer sites, were altered to serve ClickFix malware while stripping security headers to evade detection.
GoKawiil's interpretation of the reporting above, not reported fact.
Because the attack modified responses at the edge rather than on origin servers, standard file-integrity monitoring failed to catch it, showing how CDN-layer compromises can bypass conventional security checks. The incident also highlights the risk of long-lived, overly privileged API keys hardcoded in source code, and the wide blast radius possible when a marketing SaaS vendor's embedded scripts are weaponized against thousands of downstream customer sites.
- A hardcoded Cloudflare API key with full permissions let attackers create a malicious Worker undetected.
- The rogue Worker altered Brevo's forms, chat widget, and SDK scripts embedded across customer websites for over five hours.
- Security researcher Sansec estimates the malicious code may have reached up to 100,000 websites.
Source: bleepingcomputer.com, 2026-09-17
Published there as: “Brevo supply-chain attack injected ClickFix scripts on customer sites”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.