[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f97qfJ3O_94TxVaxLJbj6Uuz14zhNdy-AHZ3nU8GhLXc":3},{"article":4,"iocs":50,"watch_terms":66,"solutions":67,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"ba1d979f-4730-49ba-b211-d62d49a9104f","Brevo supply-chain attack injected ClickFix scripts on customer sites","brevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites-ff28c0","Brevo confirmed that attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its websites and JavaScript files embedded on customer sites to distribute malware. [...]","Brevo, a CRM and digital marketing company, experienced a supply-chain attack where attackers stole a Cloudflare API key to inject malicious ClickFix scripts into its websites and customer-embedded JavaScript files. The attackers used the key to create a Cloudflare Worker that modified content at the CDN edge, affecting several Brevo domains and customer sites for about five and a half hours. The injected scripts aimed to distribute malware, including a backdoor disguised as a WordPress plugin.","Brevo supply-chain attack injects malicious ClickFix scripts via stolen Cloudflare API key.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fbrevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F12\u002F10\u002Fhacker-box.jpg","2026-09-17T17:11:34+00:00","2026-09-17T18:00:36.059689+00:00",9,[17,20,23,25],{"name":18,"type":19},"Cloudflare Worker","product",{"name":21,"type":22},"Brevo","vendor",{"name":24,"type":19},"ClickFix",{"name":26,"type":19},"Web Media Optimizer","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":27,"icon":29,"name":30,"slug":31},null,"Supply Chain","supply-chain",[33,35,40,45],{"category":34},{"id":27,"icon":29,"name":30,"slug":31},{"category":36},{"id":37,"icon":29,"name":38,"slug":39},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,55,58,60,63],{"type":52,"value":53,"context":54},"url","https:\u002F\u002Fcdn10.sendibt1[.]com\u002Fp\u002Fwm.zip","URL for a malicious WordPress plugin distributed via the attack.",{"type":52,"value":56,"context":57},"https:\u002F\u002Fyelahaye[.]surf","Domain distributing the malicious WordPress plugin and scripts.",{"type":52,"value":59,"context":57},"https:\u002F\u002Fboiseno[.]club",{"type":52,"value":61,"context":62},"https:\u002F\u002Fglegchner.com\u002Fads.php","Attacker-controlled server contacted by the malicious WordPress plugin.",{"type":52,"value":64,"context":65},"https:\u002F\u002Fcorralos[.]beer\u002Fa412dkoq.js","JavaScript fetched by the plugin to display ClickFix lures.",[21,18,24],{"controls":68,"vendors":149},[69,98,127],{"slug":70,"name":71,"problem":72,"products":73},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"slug":99,"name":100,"problem":101,"products":102},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[103,111,119],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"slug":128,"name":129,"problem":130,"products":131},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[132,140,148],{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},[],{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":167},"stolen-cloudflare-api-key-enables-supply-chain-attack-via-cdn-edge-manipulation","Stolen Cloudflare API Key Enables Supply-Chain Attack via CDN Edge Manipulation","Attackers compromised Brevo's infrastructure by stealing a Cloudflare API key, which granted them the ability to deploy a malicious Worker that silently modified JavaScript delivered to customer websites at the CDN edge — without touching Brevo's origin servers directly. This attack vector is particularly dangerous because CDN-level tampering can affect thousands of downstream customers simultaneously, and the modifications are often invisible to traditional endpoint or server-side monitoring. The five-and-a-half-hour window of exposure highlights how quickly a single compromised credential can cascade into a widespread supply-chain event. This matters because customers implicitly trust scripts served from vendors they embed on their sites, making CDN-injected malware extremely effective at bypassing end-user defenses.",[155,156,157,158,159,160,161,162,163,164,165,166],"CIS Control 3: Data Protection (API key and secret management)","CIS Control 6: Access Control Management (least-privilege credentials)","CIS Control 8: Audit Log Management (CDN configuration change alerting)","CIS Control 16: Application Software Security (SRI, secure script delivery)","NIST SP 800-161: Supply Chain Risk Management","NIST CSF DE.CM-3: Personnel activity monitoring \u002F configuration change detection","NIST AC-3: Access Enforcement (restricting API key permissions)","NIST IR-6: Incident Reporting (timely customer notification)","NIST SC-18: Mobile Code (controls on externally loaded scripts)","OWASP A08:2021 – Software and Data Integrity Failures (SRI enforcement)","GDPR Article 32: Security of Processing (technical measures to ensure integrity)","GDPR Article 33: Notification of Data Breach (72-hour notification obligation)",{"NIST SP 800-161: Supply Chain Risk Management":168,"NIST IR-6: Incident Reporting (timely customer notification)":169,"CIS Control 3: Data Protection (API key and secret management)":170,"NIST AC-3: Access Enforcement (restricting API key permissions)":171,"NIST SC-18: Mobile Code (controls on externally loaded scripts)":172,"CIS Control 6: Access Control Management (least-privilege credentials)":173,"CIS Control 8: Audit Log Management (CDN configuration change alerting)":174,"OWASP A08:2021 – Software and Data Integrity Failures (SRI enforcement)":175,"CIS Control 16: Application Software Security (SRI, secure script delivery)":176,"GDPR Article 33: Notification of Data Breach (72-hour notification obligation)":177,"GDPR Article 32: Security of Processing (technical measures to ensure integrity)":178,"NIST CSF DE.CM-3: Personnel activity monitoring \u002F configuration change detection":179},"Supply chain risk management helps customers recognise that a provider's CDN credentials can affect their own sites.","Timely incident reporting ensures downstream customers learn of tampered scripts and can respond.","Protecting secrets like the Cloudflare API key, through vaulting and rotation, would reduce the chance of theft enabling edge tampering.","Restricting what the API key can do enforces least privilege, limiting the damage of theft.","Controls on externally loaded scripts help limit the impact of modified JavaScript delivered from a CDN.","Scoping the API key to least privilege would prevent a stolen key deploying Workers that modify customer JavaScript.","Alerting on CDN configuration changes, such as a new Worker, would detect the malicious edge modification quickly.","Software and data integrity failures include unverified scripts, which SRI enforcement would address.","Subresource integrity on scripts would cause browsers to reject JavaScript modified at the CDN edge.","If tampered scripts exposed personal data, notification to the supervisory authority within 72 hours is required.","Ensuring integrity of systems that process personal data includes protecting delivered scripts from tampering.","Detecting unexpected configuration changes, such as a new Worker deployment, helps spot misuse of a stolen key."]