# The newsletter script served ClickFix

2026-09-20

A Cloudflare Worker on Brevo’s own account injected a fake “verify you are human” prompt into customer marketing scripts for a few hours on 14 September. The origin files never changed.

Canonical: https://www.fabiocti.com/notes/the-newsletter-script-served-clickfix/
Author: Fabio Correia

The last note on this pattern was a share link on `claude.ai`. This one is worse for a company website: the lure was the tracker you already embedded.

On 14 September an attacker used a long-lived Cloudflare API key that Brevo had stored in application source. Brevo’s own post-mortem says the key had full account permissions. With it they deployed a Worker on *Brevo’s* Cloudflare account. For about five and a half hours the Worker rewrote responses at the edge — `brevo.com`, `sibforms.com`, and the JavaScript files customers paste into their own pages. Origin files were untouched. CSP headers were stripped in transit. File-integrity monitoring on the CMS saw nothing.

Selected visitors got a fake Cloudflare “verify you are human” page and were told to paste a command on their machine. ClickFix. Sansec timed the embedded-script window at 16:05–20:13 UTC and put the downstream count above 100,000 sites. WordPress admins in that window were also hit with a plugin-upload path. Brevo says app.brevo.com was not modified at source. That is not the same as “visitors were safe.”

## Why your SOC will miss this

The domain is yours, or it is a vendor you already allowlisted. The certificate is valid. The `Last-Modified` on the CDN object can stay the same. There is no phishing mail to pull. There is no lookalike registrar. A user who “only opened our contact page” can still have run the payload.

This is not a compromise of every Brevo customer account. It is a compromise of the pipe those accounts publish through. The earlier SAML incident on 10 September (138 accounts, some used to send mail) is a separate door. Do not collapse them into one ticket called “Brevo got hacked.” One is account takeover. One is the CDN lying about what your `<script src>` contains.

## What to do if that script is on a property you own

Assume the four-hour window is the *injection*. The machines that ran the command are a different clock. Check admin workstations that were logged into WordPress that afternoon. Look for a plugin nobody authorised. Rotate the Cloudflare and Brevo credentials that were not in a vault. If you only rebuilt the origin, you rebuilt the wrong copy.

A marketing pixel with a valid cert is now a delivery channel. Treat vendor JS like a remote installer you did not sign. The next one will not be named Brevo.