Brevo ClickFix Attack: Beware Fake Verification Commands
Brevo's post-mortem explains how compromised website scripts showed some visitors a fake verification prompt. The crucial boundary: a human check should not ask you to run a command on your computer.
The short version
What you need to know
- Brevo says an attacker changed content at its delivery network on 14 September; the post-mortem was reported on 17 September.
- The fake verification prompt asked selected visitors to run a Windows command. Seeing the prompt is not the same as executing it.
- Brevo removed the malicious delivery code, but that does not clean an already infected computer or a backdoored customer website.
What Brevo disclosed
Brevo's post-mortem, covered by BleepingComputer on 17 September, describes an attack on 14 September using a compromised Cloudflare API key. The attacker deployed a Worker that altered web responses at the content-delivery network rather than changing Brevo's original application files.
Brevo places the overall impact between 15:01 and 20:30 UTC. Its timeline says the attacker added malicious code to three JavaScript files embedded on customer websites at 16:07. Those different starting points matter: not every affected surface was exposed for the whole window.
Selected visitors saw a fake Cloudflare-branded verification page asking them to paste and run a Windows command. Brevo says following the instructions downloaded malware. The company says app.brevo.com, its API, email sending and customer account data were not affected by this incident. That statement should not be confused with its separate earlier SSO incident.
Why a familiar website was not enough
The practical problem is third-party code: a site you recognise can embed a compromised supplier's script. A familiar domain or an encrypted connection does not prove that every prompt displayed on the page is safe. Brevo says the malicious page appeared selectively, sometimes after a genuine verification checkbox.
For ordinary visitors, the reported malware route depended on running the supplied command, not simply seeing a page. WordPress administrators faced another route: on sites embedding a Brevo widget, the script attempted to install and activate a plugin if the visitor was logged in as an administrator. An attempted installation is not proof that every such site was compromised.
What to do now
Close any verification page that tells you to open a command tool and paste instructions. Do not test the command to see what it does. If you only saw the prompt and did not run it, that alone does not establish that your computer was infected.
If you ran the command, treat the computer as compromised: disconnect it and seek trusted recovery help, or contact your IT team for a work device. Brevo advises a full antivirus scan and password changes. Use a separate clean device for account recovery, revoke existing sessions where supported and do not assume one clean scan is a complete recovery guarantee.
Site owners whose administrators visited affected WordPress sites while logged in on 14 September should review plugins and site files with their host or security team. BleepingComputer's analysis says the malicious plugin can hide from the normal plugin list, so checking that screen alone is insufficient. Brevo also advises password changes and API-key review for people who logged in through brevo.com that day.
Where a VPN cannot help
A VPN protects supported traffic between your device and the VPN server. It does not make supplier scripts trustworthy, stop you executing a malicious command or remove a hidden WordPress plugin. Here, refusing the command and investigating affected devices and sites matter more than changing your network connection.
Our earlier AmnesiaStealer article describes a separate Mac campaign using the same command-pasting trick. This Brevo disclosure adds a different lesson: the lure can arrive through a supplier embedded in a legitimate website, not just an obviously suspicious download page.
Primary reading
Sources and further reading
We add plain-English context and practical advice. These links let you inspect the underlying reporting, research and official guidance directly.
