Brevo Supply-Chain Attack: Stolen Cloudflare API Key Used to Inject ClickFix Malware — Detection and Remediation Guide | Security Arsenal

Brevo (formerly Sendinblue), the email marketing and CRM platform used by hundreds of thousands of organizations, confirmed that attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into Brevo's own websites and — critically — into JavaScript files that Brevo customers embed on their own sites for features like forms, chat widgets, and marketing automation tracking. This is a textbook supply-chain compromise: organizations that never interacted with Brevo directly still served attacker-controlled JavaScript to their own visitors simply by loading Brevo's embedded scripts.

The payload delivery mechanism is ClickFix, the social-engineering technique that has dominated initial-access tradecraft through 2025 and into 2026. Victims are shown a fake CAPTCHA, browser update prompt, or "verification" dialog and instructed to press Win+R, paste a clipboard-copied command, and hit Enter. That single paste executes a malicious command — typically mshta, powershell, or curl-based — directly in the context of the logged-on user, bypassing most email and browser-based delivery controls because nothing malicious ever traverses the perimeter as a file.

If your organization embeds Brevo JavaScript on any web property, you need to treat this as an active incident: assume the script may have served ClickFix lures to your users, hunt for execution artifacts on endpoints, and rotate any credentials tied to the affected infrastructure. This post breaks down the attack chain, gives you detection logic for both the injection vector and the ClickFix execution behavior, and provides concrete remediation steps.

Technical Analysis

Affected Products and Platforms

Brevo web properties and embedded JavaScript — the injected scripts were placed into Brevo-hosted JS files that customers load via <script> tags on their own websites (forms, chat, tracking, marketing automation widgets).
Downstream customer websites — any site embedding Brevo JS was a potential distribution point. Impact depends on when the malicious content was live relative to a site's traffic window.
Cloudflare infrastructure abuse — the attackers leveraged a stolen Cloudflare API key to modify content served through Cloudflare, which means the compromise happened at the CDN/edge layer, not by breaching Brevo's origin servers directly. This is a critical distinction: the API key granted the ability to alter what visitors received without touching backend systems.
End-user endpoints — the ultimate target is the workstation of any user who followed the ClickFix instructions, typically Windows machines executing mshta.exe, powershell.exe, or wscript.exe via the Run dialog.

Attack Chain (Defender's View)

Credential theft: Attackers obtained a Cloudflare API key associated with Brevo. The theft vector isn't fully disclosed, but API keys leak through CI/CD logs, developer workstations, exposed repositories, infostealer infections, and overly permissive token storage. This is why token hygiene matters as much as endpoint security.
Edge-layer injection: Using the stolen key, the attackers modified JavaScript assets served via Cloudflare — injecting ClickFix loader code into files already trusted and embedded by customer sites.
Trust exploitation: Customer sites loaded the poisoned JS from Brevo's legitimate domain. No CSP violation, no suspicious domain, no browser warning — the script came from a vendor the site already whitelisted.
ClickFix lure: Victims saw a fake verification prompt (CAPTCHA-style or "browser error") instructing them to open the Run dialog (Win+R) and paste a command silently copied to their clipboard by the injected JavaScript.
Execution: The pasted command — typically a one-liner invoking mshta.exe with a remote URL, or a PowerShell download cradle — executed malware on the endpoint. Because the user "ran it themselves," many application-control and attachment-sandboxing controls are blind to it.

Exploitation Status

This is confirmed active exploitation in the wild — the scripts were injected and served to real visitors, and Brevo has publicly confirmed the incident. There is no CVE associated with this attack; the root cause is credential compromise and abuse of legitimate CDN functionality, not a software vulnerability. Do not wait for a CVE to act — credential-based supply-chain attacks never have one.

Why This Pattern Matters in 2026

ClickFix (and variants like FileFix) has become the dominant social-engineering execution technique because it inverts the trust model: the user becomes the delivery mechanism. Combined with third-party script supply-chain injection — the same blast-radius logic as the Polyfill.io compromise and earlier Magecart campaigns — a single stolen API key can put a lure in front of millions of visitors across thousands of sites simultaneously. If you embed third-party JavaScript without integrity controls, your site's security posture is the weakest posture of every vendor in your <script> tags.

Detection & Response

Detection must cover two planes: endpoint execution (the ClickFix paste-and-run behavior) and web asset integrity (was your site serving tampered third-party JS). The endpoint side is the highest-fidelity detection surface — ClickFix has a distinctive parent-process signature because commands pasted into the Run dialog execute as children of explorer.exe, an abnormal parent for mshta.exe, powershell.exe, and wscript.exe in most environments.

YAML

---
title: ClickFix Execution - Script Host Spawned from Explorer Run Dialog
id: 3f8b2c14-7a9e-4d51-b6c3-2e1f9a8d7c55
status: experimental
description: Detects mshta, powershell, wscript, cscript, or curl spawned directly by explorer.exe, consistent with ClickFix-style commands pasted into the Windows Run dialog after clipboard-based social engineering.
references:
  - https://attack.mitre.org/techniques/T1204/001/
  - https://attack.mitre.org/techniques/T1059/
  - https://www.bleepingcomputer.com/news/security/brevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.user_execution
  - attack.t1204.001
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_child:
    Image|endswith:
      - '\mshta.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\curl.exe'
      - '\rundll32.exe'
  filter_conhost:
    CommandLine|contains:
      - '\\?\C:\WINDOWS\system32\conhost.exe'
  condition: selection_parent and selection_child and not filter_conhost
falsepositives:
  - Administrators legitimately launching scripts from the Run dialog or File Explorer address bar
  - Software installers launched manually by users
level: high
---
title: ClickFix Staging - PowerShell or Mshta with Remote URL in Command Line
id: 9d4e7a21-3c6f-4b82-a915-8f2c6d1e4b77
status: experimental
description: Detects mshta.exe or PowerShell invoked with an inline URL argument, a common ClickFix staging pattern where the pasted command retrieves a remote payload. Also catches common download-cradle verbs.
references:
  - https://attack.mitre.org/techniques/T1218/005/
  - https://attack.mitre.org/techniques/T1105/
  - https://www.bleepingcomputer.com/news/security/brevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1218.005
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\mshta.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_url:
    CommandLine|contains:
      - 'http://'
      - 'https://'
  selection_cradle:
    CommandLine|contains:
      - 'Invoke-Expression'
      - 'IEX'
      - 'DownloadString'
      - 'DownloadFile'
      - 'Start-BitsTransfer'
      - 'hidden'
      - 'bypass'
      - '-enc '
      - '-w hidden'
  condition: selection_img and (selection_url or selection_cradle)
falsepositives:
  - Legitimate IT automation and software deployment scripts
  - Browser-launched mshta for legacy internal web applications (rare)
level: high
---
title: ClickFix RunMRU Artifact - Suspicious Command in Run Dialog History
id: 6c1a8f43-2b7d-4e59-93a6-4d8f2c7b1e99
status: experimental
description: Detects writes to the RunMRU registry key containing script hosts, encoded commands, or URLs. RunMRU records commands typed or pasted into the Windows Run dialog and is a high-value forensic artifact for ClickFix activity.
references:
  - https://attack.mitre.org/techniques/T1204/001/
  - https://www.bleepingcomputer.com/news/security/brevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.user_execution
  - attack.t1204.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains: '\Explorer\RunMRU'
  selection_value:
    Details|contains:
      - 'mshta'
      - 'powershell'
      - 'pwsh'
      - 'wscript'
      - 'cscript'
      - 'http://'
      - 'https://'
      - 'curl '
      - '-enc'
  condition: selection_key and selection_value
falsepositives:
  - Administrators running legitimate maintenance commands via the Run dialog
level: medium

The first rule is your primary tripwire — explorer.exe spawning script hosts is the signature behavior of the paste-and-run flow and is rare enough in most environments to be actionable. Tune with a baseline of your helpdesk and power-user activity before enabling at high severity. The RunMRU rule requires Sysmon registry events (Event ID 13) or equivalent EDR telemetry, but it catches the activity even if the user never pressed Enter — the MRU entry is written when the dialog closes.

KQL — Microsoft Sentinel / Defender

// Hunt: ClickFix-style execution - script hosts spawned from explorer.exe
// Correlate with clipboard-adjacent behavior and remote URL arguments
let ScriptHosts = dynamic(["mshta.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","curl.exe","rundll32.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ (ScriptHosts)
| where ProcessCommandLine has_any ("http", "https", "-enc", "bypass", "hidden", "IEX", "DownloadString")
   or FileName =~ "mshta.exe"
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, ReportId, SHA256
| order by TimeGenerated desc;

// Companion hunt: mshta.exe making outbound network connections (payload retrieval)
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "mshta.exe"
| where RemoteUrl !has_any ("microsoft.com", "windows.com", "office.com")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
| order by TimeGenerated desc;

VQL — Velociraptor

-- ClickFix endpoint triage: RunMRU history + suspicious script-host processes
-- Artifact 1: Pull RunMRU registry values per user to reconstruct what was pasted into the Run dialog
SELECT Key.FullPath AS RegistryKey,
       Name AS MRUEntry,
       Data.value AS CommandTyped,
       Key.Mtime AS LastWrite
FROM foreach(row={
    SELECT FullPath FROM glob(glob='HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Explorer/RunMRU', accessor='registry')
}, query={
    SELECT Key, Name, Data FROM stat(filename=FullPath, accessor='registry')
})
WHERE CommandTyped =~ '(?i)(mshta|powershell|pwsh|wscript|cscript|curl|http)'

-- Artifact 2: Live processes - script hosts with URL arguments (active ClickFix staging)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(mshta|powershell|pwsh|wscript|cscript)'
  AND CommandLine =~ '(?i)(http://|https://|-enc|downloadstring|invoke-expression|iex)'

PowerShell

# ClickFix / Brevo Supply-Chain Incident Triage Script
# Run elevated on suspected endpoints. Read-only audit - no changes made.

$report = @()

# 1. Pull RunMRU history for all loaded user hives - ClickFix paste artifacts
Write-Host "[*] Checking RunMRU Run-dialog history..." -ForegroundColor Cyan
$runMruPaths = Get-ChildItem "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" -ErrorAction SilentlyContinue
foreach ($path in $runMruPaths) {
    $props = Get-ItemProperty $path.PSPath
    foreach ($p in $props.PSObject.Properties) {
        if ($p.Name -match '^[a-z]$' -and $p.Value -match '(?i)(mshta|powershell|pwsh|wscript|cscript|curl|http)') {
            $report += [PSCustomObject]@{Type='RunMRU'; Entry=$p.Name; Value=$p.Value}
        }
    }
}

# 2. Recent Prefetch for script hosts (execution evidence within ~last 30 days)
Write-Host "[*] Checking Prefetch for script host execution..." -ForegroundColor Cyan
Get-ChildItem "C:\Windows\Prefetch" -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match '(?i)MSHTA|POWERSHELL|WSCRIPT|CSCRIPT' -and $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
    ForEach-Object { $report += [PSCustomObject]@{Type='Prefetch'; Entry=$_.Name; Value=$_.LastWriteTime} }

# 3. Recently created scheduled tasks (common post-ClickFix persistence)
Write-Host "[*] Checking recently created scheduled tasks..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-14) } |
    ForEach-Object { $report += [PSCustomObject]@{Type='SchedTask'; Entry=$_.TaskName; Value=$_.TaskPath} }

$report | Format-Table -AutoSize
$report | Export-Csv -Path "$env:TEMP\clickfix_triage_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
Write-Host "[+] Triage complete. Review CSV output in $env:TEMP" -ForegroundColor Green

Remediation

For Organizations Embedding Brevo JavaScript

Determine exposure window: Identify every web property embedding Brevo scripts (search your codebase and tag managers for brevo, sendinblue, sibautomation, and related script origins). Cross-reference with Brevo's disclosed timeline to determine whether your visitors could have been served the injected content.
Treat impacted visitors as potentially compromised: If your site served the tampered JS during the exposure window, hunt endpoints that browsed those pages using the detections above. Prioritize workstations of employees who visited internal portals embedding Brevo widgets.
Deploy Subresource Integrity (SRI) where supported: Pin third-party scripts with integrity attributes so tampered content fails to execute. Where the vendor serves dynamic JS (which breaks static SRI), move to a self-hosted snapshot model or a CSP with strict script-src allowlisting and require-trusted-types-for where feasible.
Enforce Content Security Policy: A restrictive CSP that only allows scripts from known, pinned origins — combined with reporting via report-uri/report-to — gives you both a control and a telemetry source for unauthorized script injection.
Block ClickFix execution at the endpoint: Where business need permits, disable or constrain mshta.exe (it is deprecated and rarely legitimate), and implement WDAC/AppLocker rules blocking script hosts for standard users. Consider disabling the Run dialog for non-admin users via policy where operationally acceptable.

Credential and CDN Hygiene (The Root Cause)

Rotate Cloudflare API tokens immediately if you have any doubt about exposure — and prefer scoped API tokens over global API keys. Cloudflare's global API key grants account-wide control; scoped tokens limit blast radius to specific zones and permissions. Verify tokens via the API (GET /user/tokens/verify) and audit token usage in the Cloudflare audit log for anomalous IPs or actions.
Eliminate long-lived static keys in CI/CD and developer environments: Use short-lived credentials (OIDC-based federation) where possible. Store secrets in a vault, never in repositories, environment files committed to source control, or plain-text config.
Alert on API key usage anomalies: Cloudflare audit logs can be streamed via Logpush to your SIEM. Alert on token use from unexpected geographies/ASNs, modification of Workers, routes, DNS, or page rules, and key creation events.
Enable MFA and least-privilege on all CDN/DNS accounts: A single API key should never be able to alter production content served to customers without a second control (change-management approval, dual authorization for Workers/route changes).

User-Facing Controls

Train specifically on ClickFix: Generic phishing training does not cover paste-and-run lures. Add explicit guidance: no legitimate website will ever ask you to press Win+R and paste a command to "verify" yourself or "fix" a browser error. This is a 100% malicious indicator.
Clipboard monitoring/hardening: Some EDR platforms and browser extensions can detect or block JavaScript clipboard writes (navigator.clipboard.writeText) triggered without a genuine user gesture — evaluate for high-risk user populations.
Monitor Brevo's official communications: Follow Brevo's incident disclosures and the original reporting at BleepingComputer for updated indicators, exposure windows, and vendor guidance. If Brevo publishes IOCs (hashes, domains, payload URLs), ingest them into your blocklists and retro-hunt across the full exposure window.

Incident Response Considerations

If you confirm ClickFix execution on an endpoint: isolate the host, capture memory and the RunMRU/Prefetch artifacts before remediation, pull the full command line and network telemetry to identify the second-stage payload, and assume credential theft — ClickFix droppers frequently deliver infostealers. Reset credentials for any session or browser-stored secrets on the affected machine, and review downstream access from that host. Supply-chain incidents have long tails: preserve web server and CDN logs now, before retention windows expire, because victim identification may continue for weeks as the vendor refines its timeline.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub

Brevo Supply-Chain Attack: Stolen Cloudflare API Key Used to Inject ClickFix Malware — Detection and Remediation Guide