The instruction was three keystrokes: press Win+R, then Ctrl+V, then Enter.
It appeared on a full-screen, Cloudflare-branded page — “Cloudflare, verify you are human” — often arriving seconds after a visitor had already clicked a genuine Cloudflare checkbox. Following the steps ran a command that the malicious script had quietly placed on the clipboard, and that command downloaded malware onto a Windows machine.
Brevo’s own post-mortem puts the impact window at 15:01 to 20:30 UTC on 14 September 2026. That is 5h29.
The domain is real. The certificate is valid. The widget is the vendor’s own code. The verified badge is genuine. The voice is the officer’s voice.
Here is the part that should end the argument about whether this was a phishing problem. The domain was brevo.com. The script was Brevo’s own embedded JavaScript, the widget customers paste into their sites to collect signups. Nothing on Brevo’s origin servers was modified. A Cloudflare Worker rewrote responses in transit at the CDN edge and stripped security headers, including Content-Security-Policy, so the files on disk stayed clean and standard integrity checks never noticed.
Brevo traced it to a long-lived Cloudflare API key with full account permissions, stored in application source code. With it, an attacker created Workers, routes, and DNS records on Brevo’s zones without triggering an alert. The key was first misused in late August. Nothing was injected into customer-facing pages before 14 September.
The injection hit brevo.com, sendinblue.com, the login and onboarding subdomains, sibforms.com, the Brevo forms script, the Conversations widget, and the SDK loader — plus three JavaScript files that customers embed on their own websites, including the WordPress widget.
On WordPress sites running that widget, the script tried something extra: if the visitor happened to be logged in as a site administrator, it attempted to silently install and activate a plugin. Sansec, citing a source-code search of the affected components, estimated the ClickFix could have reached more than 100,000 websites.
The fake page was served selectively. Most visitors, and nearly every repeat visit, saw nothing at all.
That selectivity is the design, not a bug. It keeps the payload alive long enough to collect the people who matter, and it keeps the people who would report it from ever seeing it.
Now leave the browser.
Kaspersky found iTorrents.org compromised, and as of its report, still compromised. Torrents disguised as popular and pirated films — including Christopher Nolan’s The Odyssey, a film that had only been released in theaters — were delivering an 865-megabyte .exe instead of a video file. PCMag visited the site and immediately triggered a browser download of a torrent for a mysterious executable; Windows Defender later flagged it as severe malware, “Trojan;Win32/Sonbokli.A!cl.”
The malware loader deploys a framework Kaspersky calls MovieReaper, which contains 21 different functions, including the ability to download, upload, and read files on the system and to exfiltrate them. It communicates back to its operators through the Solana blockchain.
The victim count is in the several hundreds, across individuals and organizations in Russia, Japan, Spain, the Netherlands, and Colombia. The sectors Kaspersky lists — enterprise, government, IT, consulting, retail, transportation, agriculture — are not the profile of people chasing free movies on a work laptop. They are the profile of people who clicked something that looked like a file.
The reason iTorrents.org mattered is the same reason Brevo mattered. It was a repository that other torrent trackers relied on. As Kaspersky put it, torrent trackers that relied on this repository began inadvertently distributing malicious torrent files to their users, letting attackers reach users of multiple trackers without compromising each platform individually.
One compromised cache. Many front doors. None of them looked broken.
Then there is the phone.
Between January 2025 and July 2026, the FBI’s Internet Crime Complaint Center logged nearly 61,000 complaints of law enforcement or government impersonation scams, with losses over $1.6 billion. For comparison, the FBI’s earlier reports logged just over 11,000 victims in each of 2021 and 2022.
The FBI’s newest advisory describes scammers spoofing phone numbers from police departments and government agencies, opening with accusations — a crime, a missed jury duty, an expiring medical license — and threatening severe consequences. Payment is demanded through prepaid cards, couriers, bank wires, cryptocurrency, or cash inserted into cryptocurrency kiosks.
And the FBI now warns that AI is doing the persuasion. Deepfaked voices and faces let scammers appear as law enforcement and government officials on video calls, which the advisory says adds “the appearance of legitimacy to the scam.”
Read that again as a consumer, not a security engineer. The last reliable check most people had — does this sound like a real official, does this look like a real person — has been automated into a product.
Three incidents, one mechanism. Attackers are no longer imitating trusted entities. They are borrowing trusted entities’ own infrastructure, code, and faces.
In our guardrails issue, the question was what a model could be talked into saying. Move the same question up a layer and it becomes sharper: what can a trusted platform be made to deliver on someone else’s behalf, using nothing but its existing reputation? The domain is real. The certificate is valid. The widget is the vendor’s own code. The verified badge is genuine. The voice is the officer’s voice.
Every safety heuristic built on familiarity is now a liability, because familiarity is the inventory attackers are buying.
So here is the rule set. It is short because it has to survive contact with a real afternoon.
Never run a system command that arrived from outside your own head. Not in PowerShell, not in Terminal, not in the Run dialog. If a page asks you to press Win+R, or to open Terminal, the verification has already failed. No legitimate human-verification check has ever needed your keyboard’s clipboard.
Never pay, and never hand over personal information, because someone contacted you first. The FBI is explicit: law enforcement and government authorities will never contact members of the public by telephone or text message to demand any form of payment or to request personal or sensitive information. Anyone who does is a criminal, regardless of what the caller ID, the badge on the video call, or the chat window says.
Verify independently, or don’t act. Hang up. Look up the agency or the company using information you find yourself, not a number the caller gave you. The FBI’s wording is the right standard: ask for credentials and use official, publicly available information to contact the agency to verify the caller and their credentials — do not use contact information provided by the person contacting you.
If you already ran the Brevo command, treat that computer as compromised. Disconnect it, run a full antivirus scan, and change the passwords used on it, starting with your Brevo password.
The uncomfortable conclusion is that platform security and brand reputation have stopped being consumer safety signals. Brevo is a competent vendor that got hit through a hardcoded key and a Worker at the edge. Cloudflare is not the attacker. iTorrents.org is a free cache. None of that helps you at the moment the prompt appears.
What helps is the rule you already know and keep ignoring: the human is the last control, and the only durable one.