Brevo supply-chain attack injected ClickFix scripts on customer sites

Brevo confirmed attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its websites and JavaScript files embedded on customer sites, distributing malware. The supply-chain attack targeted the email marketing platform's infrastructure, compromising code served to visitors. Brevo did not disclose the number of affected customers or the duration of the compromise in its initial statement.