Author: DigitalSpying Security Desk
Date: September 18, 2026
Executive Summary
In one of the most widespread web application supply-chain compromises of the year, major enterprise email marketing and customer relationship management (CRM) platform Brevo (formerly Sendinblue) has disclosed a critical security incident affecting its content delivery infrastructure. As reported across the industry by BleepingComputer, SecurityWeek, and SecurityAffairs, threat actors compromised a high-privilege Cloudflare API key belonging to Brevo. The attackers used this key to deploy a rogue Cloudflare Worker serverless function that dynamically injected malicious ClickFix social engineering scripts into Brevo’s public-facing JavaScript tracking libraries (tracker.js).
Because more than 100,000 corporate, e-commerce, and SaaS websites embed Brevo's hosted tracker script to monitor user engagement and newsletter signups, millions of website visitors encountered deceptive floating error dialogs masquerading as Google Chrome, Cloudflare Turnstile, or CAPTCHA verification failures. The deceptive prompts instructed users to copy an obfuscated PowerShell snippet and paste it directly into their Windows Run dialog (Win + R), bypassing standard browser sandbox protections to deploy infostealer malware (such as Lumma Stealer and Vidar) directly onto corporate workstations.
Deep-Dive Technical Analysis
1. The Mechanics of the Cloudflare Edge Supply-Chain Hijack
Brevo utilizes Cloudflare’s global Content Delivery Network (CDN) to serve static JavaScript assets to customer websites:
* The Tracking Asset (tracker.js): Client websites embed a single