Brevo Supply Chain Attack Reveals ClickFix Script Injection

What happened to Brevo

In early 2024 Brevo, a provider of email marketing and automation tools, disclosed a supply chain breach that allowed malicious code to be placed on hundreds of customer websites. The intrusion began with the theft of a Cloudflare API key that the company uses to serve static assets and protect its network. With that credential, threat actors were able to modify JavaScript files hosted on Brevo’s domain and on sites that embed Brevo scripts.

Attack vector and stolen credentials

According to the official Brevo statement, the attackers gained access to the Cloudflare account through a credential‑reuse incident. Once inside, they altered the configuration for the CDN service, enabling them to serve altered JavaScript payloads. The compromised key gave the intruders the same level of control as Brevo’s own developers, meaning they could replace legitimate files with malicious versions without triggering typical security alerts.

Malicious ClickFix scripts explained

The altered files contained references to a third party tool called ClickFix. While ClickFix is marketed as a legitimate website performance utility, the version delivered by the attackers was packed with code that redirected visitors to a phishing landing page and attempted to download a trojanized executable. The script executed silently in the browser, leveraging the trust that users place in Brevo‑hosted resources.

Impact on customers and the broader web

Any website that included Brevo’s JavaScript library was suddenly at risk. The injection affected e‑commerce platforms, blogs, and corporate portals that rely on Brevo for newsletter sign‑ups or transactional emails. Security researchers observed that the malicious code was active for several weeks before Brevo detected the anomaly, during which time thousands of visitors were exposed to the payload.

How the injected code spread malware

The payload followed a classic supply chain pattern: it first loaded a small loader script, which then fetched a second stage payload from a remote server. The second stage performed a series of checks to confirm it was running in a browser environment, then redirected the user to a site that prompted a fake software update. If the user accepted, a Windows executable was downloaded and executed, installing a remote access trojan.

Detection and remediation steps taken by Brevo

After the breach was discovered, Brevo took several immediate actions:

1. Revoked the compromised Cloudflare API key and generated a new credential.
2. Re‑served all affected JavaScript files from clean backups.
3. Implemented stricter access controls and multi‑factor authentication for all third party integrations.
4. Notified affected customers and provided guidance on how to verify the integrity of their pages.
5. Cooperated with law enforcement and independent security firms to trace the attackers.

The company also posted a detailed incident report on its security blog, outlining the timeline and technical details of the compromise.

Lessons for businesses and developers

The Brevo breach underscores several key practices that organizations should adopt to protect their web supply chains.

Protecting API keys and third party services

API keys are often treated like passwords, yet they are frequently stored in plain text or shared across multiple environments. Best practices include:

• Storing keys in a secrets manager rather than hard‑coding them.
• Rotating credentials regularly and after any suspected breach.
• Limiting the scope of each key to the minimum permissions required.
• Enforcing multi‑factor authentication for accounts that can generate or manage keys.

Monitoring JavaScript supply chains

Websites that embed third party scripts should implement integrity checks. Subresource Integrity (SRI) tags allow browsers to verify that a fetched script matches a known hash. Additionally, continuous monitoring tools can alert administrators when a script’s hash changes unexpectedly.

Security teams can also use services that scan external scripts for known malicious patterns. Integrating these scans into the CI/CD pipeline helps catch unauthorized modifications before they reach production.

Industry response and future outlook

After the breach became public, several security agencies issued alerts. The United States Computer Emergency Readiness Team (CISA) added the incident to its advisory list, warning organizations that rely on third party JavaScript to review their supply chain defenses. The Cloudflare security blog (Cloudflare security blog) published recommendations for protecting API credentials and detecting unauthorized CDN changes.

Researchers at Krebs on Security highlighted the attack as a reminder that even well‑known services can become vectors for large‑scale malware distribution. The MITRE ATT&CK framework (MITRE ATT&CK) classifies this technique under “Supply Chain Compromise”, emphasizing the need for visibility across all third party dependencies.

Looking forward, experts expect a rise in attacks that target the infrastructure that delivers web content. As more businesses outsource critical functions to cloud providers, the attack surface expands. Organizations that adopt a zero‑trust approach to external services, enforce strict credential hygiene, and continuously verify the integrity of delivered code will be better positioned to defend against similar incidents.

For website owners who use Brevo or similar services, a practical first step is to audit all embedded scripts, verify their hashes, and replace any that cannot be validated. Regular security assessments and collaboration with service providers can further reduce the risk of future supply chain compromises.