Brevo ClickFix Incident Puts CDN Worker Controls in Supply-Chain Spotlight

Edge rewriting bypassed origin checks

Brevo said the malicious Worker rewrote responses at the CDN edge and removed security headers, including Content-Security-Policy, while origin servers and source files remained unchanged.² That failure mode meant conventional file-integrity checks at the origin were not enough to detect the injected content. BleepingComputer reported the same technical chain, tying the stolen Cloudflare API key to CDN-edge response rewriting, security-header removal and the affected embedded JavaScript assets.¹

Brevo’s post-mortem said the exposure window ran from 15:01 to 20:30 UTC on September 14. ClickFix activity on the listed customer-facing and embedded-script surfaces was active from 16:07 to 20:30 UTC.² Brevo said the key may first have been misused in late August 2026, but it found no evidence of malicious content injection into customer-facing pages before September 14.²

The mechanism matters because Cloudflare Workers and similar CDN-edge execution platforms sit between origin applications and users. When governed properly, they can enforce security controls, transform traffic and improve performance. When governed with overbroad, durable credentials, they can become a high-leverage injection point that changes responses after application builds, deployment pipelines and origin integrity controls have already completed.

ClickFix prompts and WordPress plugin attempts

Visitors selected by the malicious script saw a fake Cloudflare-branded verification page that instructed them to press Win+R, paste clipboard content and run a command. The tactic is a social-engineering pattern known as ClickFix.²³ Brevo said users who followed the prompt should treat the computer as compromised, disconnect it, run a full antivirus scan and change passwords used on the device, starting with the Brevo password.²

The attack also included a WordPress-specific path. On WordPress sites embedding affected Brevo scripts, the malicious code checked whether a visitor was logged in as an administrator and attempted to install and activate a plugin using that administrator’s existing session.²⁴ BleepingComputer reported that the plugin posed as “Web Media Optimizer” but behaved as a persistent backdoor and JavaScript loader, including persistence through the must-use plugins directory and remote script-loading behavior.¹

Cybernews reported that more than 100,000 websites may have shown ClickFix scams after the Brevo compromise, citing the broad use of Brevo tools and Sansec findings.³ CyberInsider similarly reported that malicious JavaScript was pushed through Brevo-hosted widgets and scripts. It also noted Sansec-observed Content Security Policy violations across monitored sites during and after the attack window.⁴

Remediation focused on keys, logs and edge controls

Brevo said it removed the malicious Worker and routes, revoked the compromised key and credentials created with it, deleted attacker-created hostnames, purged edge caches and verified that affected pages and scripts were serving clean content.² The company also said it removed the hardcoded credential from source code and replaced it with narrowly scoped, short-lived tokens.²

Brevo’s planned hardening measures include using HashiCorp Vault as the single store for Cloudflare keys and tokens, automatic rotation, alerting on Cloudflare audit events involving Workers, routes, DNS or account access, streaming Cloudflare logs to its security monitoring platform, and external scanning of public pages and scripts for injected content.² NEXSIGHT’s incident writeup also emphasized Brevo’s move toward centralized secret storage, Cloudflare audit-event monitoring and regular scanning of public scripts as key post-incident controls.⁶

Those steps point to a broader control lesson for SaaS providers and their customers: embedded widgets should be treated as software supply-chain dependencies with runtime privilege. Providers need least-privilege edge tokens, short credential lifetimes, source-code secret scanning, change detection for Workers and routes, and alerts on DNS or CDN configuration drift. Customers need inventories of third-party scripts, CSP reporting, subresource integrity where technically possible, and incident playbooks for trusted widget compromise.

Customer checks remain necessary

Brevo said customers can continue using its Conversations widget, SDK and forms because the files were not modified at source.² However, the company urged WordPress administrators whose sites load Brevo scripts and who visited those sites while logged in on September 14 to check for plugins installed or activated that day, remove suspicious entries and rotate administrator passwords.²

Security teams should also review CDN and DNS logs, browser CSP reports, web server logs and WordPress administrative actions around September 14 for evidence of plugin upload attempts, unexpected JavaScript loads or user reports of fake verification prompts. The incident shows that for widely embedded SaaS components, the effective trust boundary is not only the vendor’s application code. It also includes CDN workers, routes, DNS records, API tokens and the security-header enforcement path.