The newsletter script served ClickFix

The last note on this pattern was a share link on claude.ai. This one is worse for a company website: the lure was the tracker you already embedded.

On 14 September an attacker used a long-lived Cloudflare API key that Brevo had stored in application source. Brevo’s own post-mortem says the key had full account permissions. With it they deployed a Worker on Brevo’s Cloudflare account. For about five and a half hours the Worker rewrote responses at the edge — brevo.com, sibforms.com, and the JavaScript files customers paste into their own pages. Origin files were untouched. CSP headers were stripped in transit. File-integrity monitoring on the CMS saw nothing.

Selected visitors got a fake Cloudflare “verify you are human” page and were told to paste a command on their machine. ClickFix. Sansec timed the embedded-script window at 16:05–20:13 UTC and put the downstream count above 100,000 sites. WordPress admins in that window were also hit with a plugin-upload path. Brevo says app.brevo.com was not modified at source. That is not the same as “visitors were safe.”

Why your SOC will miss this

The domain is yours, or it is a vendor you already allowlisted. The certificate is valid. The Last-Modified on the CDN object can stay the same. There is no phishing mail to pull. There is no lookalike registrar. A user who “only opened our contact page” can still have run the payload.

This is not a compromise of every Brevo customer account. It is a compromise of the pipe those accounts publish through. The earlier SAML incident on 10 September (138 accounts, some used to send mail) is a separate door. Do not collapse them into one ticket called “Brevo got hacked.” One is account takeover. One is the CDN lying about what your <script src> contains.

What to do if that script is on a property you own

Assume the four-hour window is the injection. The machines that ran the command are a different clock. Check admin workstations that were logged into WordPress that afternoon. Look for a plugin nobody authorised. Rotate the Cloudflare and Brevo credentials that were not in a vault. If you only rebuilt the origin, you rebuilt the wrong copy.

A marketing pixel with a valid cert is now a delivery channel. Treat vendor JS like a remote installer you did not sign. The next one will not be named Brevo.