Brevo API-key theft turned embedded scripts into a ClickFix delivery channel

A credential with authority over customer content

A stolen secret gave an attacker a route into content delivered to Brevo customers. Brevo’s incident write-up says the attacker used a compromised Cloudflare API credential to deploy a Worker that rewrote customer-facing content at the CDN edge. The security question extends to the external services authorised to change what a business presents to visitors.

Brevo dates the overall incident to 14 September 2026, from 15:01 to 20:30 UTC, lasting 5h29. That is the vendor’s overall impact window, rather than a precise measure of every customer’s exposure.

According to Brevo, the credential was hardcoded in application source and granted full account permissions. Storage and authority deserve separate scrutiny: moving a secret without reducing its permissions would address only part of the concern.

Three observation sets, not one victim count

Sansec reported that malicious code reached more than 100 thousand customer sites. This is Sansec’s reach estimate, not a Brevo-confirmed total of infected endpoints. Site reach does not establish how many devices suffered a subsequent compromise.

Sansec recorded 2,549 Content Security Policy violation reports across 12 sites, during and after its observed attack window. These reports are a distinct observation set. They should not be added to the site estimate or treated as a victim count.

ADAMnetworks found public browser captures across 51 page domains. That is a count of observed domains, measuring a different population from Sansec’s estimate. Keeping the units separate makes the findings more useful when defenders compare their own records with published observations.

The changes could be small: ADAMnetworks reported additions of 173 or 174 bytes to affected JavaScript assets. File-size changes can guide an investigation, but should not become the sole test for malicious content.

A review agenda for Algerian website operators

The Algeria connection depends on which integrations an organisation actually uses. These facts do not establish a specific Algerian victim. For businesses embedding externally managed marketing components, the useful response is a trust review.

Start by listing external scripts and their owners. Map the credentials that can modify those scripts or their delivery, then ask whether their permissions and lifetime are necessary. Record who can revoke access and how the team would examine or suspend an affected integration. Conclusions about local exposure should rely on the organisation’s evidence.

Brevo says it replaced the hardcoded credential with narrowly scoped, short-lived tokens. That is a concrete point of comparison. The review should reduce the authority and lifetime of credentials capable of changing customer-facing content, rather than end with a new storage location for an equally powerful secret.

Frequently Asked Questions

Sources & Further Reading

• Brevo
• Sansec
• ADAMnetworks