Updated 9/18: This article has been updated to include additional details from Brevo and new research findings that were unavailable at press time.
Brevo, an email marketing and CRM platform, has been implicated in a ClickFix malware operation that rode through its own tracker and form scripts onto customer Shopify sites, exposing visitors to a fake verification prompt that tried to trick them into running malicious commands on their own machines.
At the time of publication Brevo had not publicly addressed the Sept. 14 ClickFix/tracker incident researchers at ADAMnetworks documented. At the the time, it did admit to a separate, related breach four days earlier.
Updated 9/18: Brevo has since confirmed the Sept. 14 incident and disclosed its root cause. Portions of the article that have been updated and added are indicated via italicized fonts.
Brevo’s Own Take
Brevo, in a post-mortem write up posted Thursday, says attackers compromised its Cloudflare account and turned trusted web infrastructure into a malware delivery mechanism, injecting malicious code into Brevo websites and JavaScript used by customers including online stores.
For roughly five and a half hours on Sept. 14, selected visitors could be shown a fake Cloudflare “verify you are human” screen that instructed them to press Win+R, paste a command and execute it. Brevo says users who followed those instructions downloaded malware onto their Windows computers.
The company said the attacker obtained a long-lived Cloudflare API key with full account permissions that had been stored in Brevo application source code. The credential allowed the attacker to create Cloudflare Workers, routes and DNS records across Brevo-controlled zones without triggering an alert.
The attacker did not have to modify Brevo’s underlying files. Instead, a malicious Cloudflare Worker rewrote content as it passed through Cloudflare’s CDN edge and removed security headers including Content-Security-Policy, according to Brevo.
Brevo said its application at app.brevo.com, API, email-sending infrastructure and customer account data were not affected by the Sept. 14 attack.
The disclosure largely confirms independent findings published earlier by ADAMnetworks and Sansec, while resolving one of the biggest questions surrounding the incident: how malicious JavaScript could appear through Brevo infrastructure even though its source files appeared unchanged.
How the ClickFix Scam Worked
As ADAMnetworks described the Brevo incident, ClickFix scams are particularly nefarious because they do not rely on browser or system vulnerabilities, but rather operate strictly on social engineering via convincing a visitor to run a malicious command themselves.
The way a victim might fall prey to this specific ClickFix ploy is by shopping at a small online store using Brevo’s Shopify integration to manage email signups and customer messaging. Nothing about the site looks unusual. Then a full-screen overlay appears: a routine-looking “verify you’re human” check, styled to resemble a familiar anti-bot screen.
ADAMnetworks documented exactly this happening on a real Shopify storefront and later a Reddit users who identified themselves as store owner also shared similar incident. The ploy was triggered by the “verify you’re human” button. When clicked it the shopper actually copied a malicious command to their computer’s clipboard.
The overlay panel then directed them through the next steps which included, press the Windows key + R, paste with Ctrl+V, click OK. Translation: open Windows’ Run dialog and execute whatever’s sitting in the clipboard, no technical knowledge required.
That command launched a hidden command-prompt session and reached out to one of several attacker-controlled servers for further instructions. ADAMnetworks didn’t confirm what malware, if any, ultimately reached a victim’s machine in these incidents or if the goal was account theft, fraud, or botnet enrollment – each associated with ClickFix campaigns.
What Brevo Has Confirmed
A separate security firm, Sansec, has since reported that the Sept. 14 ClickFix activity may be connected to incident Brevo described. Sansec believes ClickFix adversaries used the same access flaw outlined by Brevo via the company’s third-party DNS and content-delivery provider. Sansec says the provider could have let attackers alter DNS records and content across Brevo-controlled domains.
Both ADAMnetworks and Sansec agree on the core mechanics of the attack. Adversaries used malicious JavaScript through Brevo’s form infrastructure, the same fake verification prompts and the same delivery window. They diverge sharply on scale.
ADAMnetworks confirmed 51 domains where it directly observed the malicious script live. Sansec’s estimate is far broader, reporting 100,000+ sites it says were capable of serving the script, based on how widely Brevo’s code is embedded, not sites it individually confirmed.
Updated 9/18: Brevo’s investigation fills in the missing technical piece. The compromised Cloudflare credential allowed the attacker to create Workers, routes and DNS records across Brevo-controlled zones. The malicious Worker injected code into Brevo properties and into JavaScript components that customers embed on their own websites, effectively allowing the attack to spread through Brevo’s web supply chain. Brevo says the malicious activity lasted roughly five and a half hours.
Sansec also found that on WordPress sites using an affected Brevo component, the malicious code could attempt to silently install and activate a plugin when a logged-in administrator visited the site.
Sansec also found the malicious script on Brevo’s own booking pages and chat widget, beyond the tracker and forms found on shopping sites such as Shopify, which hosted Brevo’s CRM consumer-facing tools.
Brevo has not confirmed either firm’s account of what happened.
How It Was Found
ADAMnetworks estimates the malicious scripts were live for roughly four hours on Sept.14, first spotted on a customer’s Shopify storefront and on Brevo’s own website. The latter was flagged publicly on X by a user who tagged Brevo’s official account.
“Brevo’s own infrastructure served malicious JavaScript through its tracker scripts and hosted forms,” a ADAMnetworks researcher explained.
Brevo has acknowledged the reports, but issued an official public statement on the cause. It did note that the attacker-controlled domains serving the malicious script were dead by Sept. 15. Brevo and Sibforms (Brevo’s own form-hosting domain) users aren’t facing any related threats.
ADAMnetworks recommends security professionals check tracker and form files against known-clean byte sizes to confirm you weren’t exposed during the window.
What Still Isn’t Known
Updated 9/18: The initial access mystery is considerably clearer: Brevo attributes the compromise to the exposed Cloudflare API key and the attacker’s use of a malicious Cloudflare Worker. What remains unclear is the ultimate victim count and downstream impact.
ADAMnetworks documented the malicious script across 51 domains, while Sansec estimates that Brevo components capable of delivering the code were present on more than 100,000 sites. Neither figure establishes how many visitors actually saw the ClickFix prompt, how many followed its instructions, or how many WordPress sites may have received the malicious plugin.
It also remains unclear whether the Sept. 14 Cloudflare compromise was connected in any way to Brevo’s separate Sept. 10 SSO incident. Brevo has publicly described different mechanisms for the two events, but has not established a connection between them.
At the time of publication, neither ADAMnetworks nor Sansec has identified how attackers altered Brevo’s tracker, form, and chat-widget scripts in the first place. Sansec theorizes the intrusion ran through Brevo’s DNS and CDN account, possibly tied to the SSO breach four days earlier.
The two researchers don’t agree on scope, either: ADAMnetworks documented 51 affected domains; Sansec puts capable sites at 100,000+. Neither figure is confirmed by Brevo.
Victim impact is also murky. No confirmed count of visitors who ran the malicious command, no confirmed payload.
Brevo has not issued a public statement on the Sept. 14 incident whether it be the initial access point, root cause, true scope or official remediation.
Security Point Break reached out to both Brevo and Cloudflare for comment. Both requests are pending.
Editor’s Note: This story was materially updated on Sep. 18 with information provided by Brevo via a blog post “Post-mortem: malicious ‘ClickFix’ script served via Brevo’s Cloudflare account“. SPB has indicated where the story has been updated inline. Portions of the article that have been added are indicated via italicized fonts.
