# Brevo breach spreads ClickFix malware to 100,000 sites

> A hacker stole an API key from the marketing platform and injected fake verification screens across thousands of websites.
- Title: Brevo breach spreads ClickFix malware to 100,000 sites · PCMAG
- Summary: A hacker stole an API key from the marketing platform and injected fake verification screens across thousands of websites. Hackers are exploiting breaches at…
- Keywords: breaking, brevo, cloudflare, api key theft, clickfix malware, supply chain attack, malware distribution, social engineering, javascript injection, wordpress widget, cybersecurity breach, technology
- Source: PCMAG — https://pcmag.com/news/hack-at-marketing-vendor-exploited-to-widely-spread-clickfix-malware-attack
- Author: Michael Kan
- Published: 2026-09-17T22:01:01+00:00
- Read time: 1 min
- Topics: breaking, brevo, cloudflare, api key theft, clickfix malware, supply chain attack, malware distribution, social engineering, javascript injection, wordpress widget, cybersecurity breach, technology
## Marketing platform breached
A hacker stole a long-lived API key from Brevo, a French email and text marketing provider, through Cloudflare infrastructure.
## Malicious code injected widely
The attacker injected malicious code into Brevo's main domain, a related domain, and three JavaScript files that thousands of customer websites embed.
## Fake verification screen deployed
Visitors saw a fake Cloudflare verification page instructing them to paste and run a command, a social engineering technique called ClickFix.

> The script showed selected visitors a fake 'Cloudflare, verify you are human' page that instructed them to paste and run a command on their computer, a social-engineering technique known as ClickFix
## How ClickFix tricks users
The fake page told users to press Win+R, then Ctrl+V, then Enter, which ran a malicious command and downloaded malware onto Windows computers.
## Attack reached 100,000 sites
The ClickFix malware persisted for about five and a half hours and may have reached over 100,000 websites through Brevo's compromised components.
## Key stolen months earlier
Brevo found evidence the API key was first misused in late August 2026, though it's unclear how the hacker originally obtained it.
## Part of larger trend
Hackers are increasingly hijacking official accounts and services to spread ClickFix attacks, like when HBO Max's Reddit account was recently compromised.
## How to stay safe
Avoid websites that ask you to manually perform keyboard instructions. That's a red flag you're encountering a ClickFix-style attack.
## Key takeaway

Hackers are exploiting breaches at major service providers to spread malware at massive scale through trusted platforms.