Marketing platform breached

A hacker stole a long-lived API key from Brevo, a French email and text marketing provider, through Cloudflare infrastructure.

Malicious code injected widely

The attacker injected malicious code into Brevo's main domain, a related domain, and three JavaScript files that thousands of customer websites embed.

Fake verification screen deployed

Visitors saw a fake Cloudflare verification page instructing them to paste and run a command, a social engineering technique called ClickFix.

“The script showed selected visitors a fake 'Cloudflare, verify you are human' page that instructed them to paste and run a command on their computer, a social-engineering technique known as ClickFix”

How ClickFix tricks users

The fake page told users to press Win+R, then Ctrl+V, then Enter, which ran a malicious command and downloaded malware onto Windows computers.

Attack reached 100,000 sites

The ClickFix malware persisted for about five and a half hours and may have reached over 100,000 websites through Brevo's compromised components.

Key stolen months earlier

Brevo found evidence the API key was first misused in late August 2026, though it's unclear how the hacker originally obtained it.

Part of larger trend

Hackers are increasingly hijacking official accounts and services to spread ClickFix attacks, like when HBO Max's Reddit account was recently compromised.

How to stay safe

Avoid websites that ask you to manually perform keyboard instructions. That's a red flag you're encountering a ClickFix-style attack.