conv.

← The whole story
Security
Brevo supply-chain attack injects ClickFix malware via Cloudflare API theft

Brevo confirms supply-chain attack to media outlets

Brevo publicly acknowledged the breach and detailed how attackers exploited the compromised Cloudflare API key to distribute ClickFix malware across thousands of websites via the company's embedded JavaScript files.

Brevo confirms supply-chain attack to media outlets
pcmag.com

“Brevo confirmed that attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its websites and JavaScript files embedded on customer sites to distribute malware.”

Brevo

Brevo Compromised email and marketing providerCloudflare Infrastructure provider

The whole story posts the bright band is this development · numbered dots are the others · click one to jump

Peak 2 pieces in two hours at Sep 17, 11 AM; 7 pieces over 8 days (1 article · 6 posts) Sep 16, 3 PM — 1 piece · 1 post — Mastodon 1Sep 16, 5 PM — quietSep 16, 7 PM — quietSep 16, 9 PM — quietSep 16, 11 PM — quietSep 17, 1 AM — quietSep 17, 3 AM — quietSep 17, 5 AM — quietSep 17, 7 AM — quietSep 17, 9 AM — quietSep 17, 11 AM — 2 pieces · 1 article · 1 post — Mastodon 2Sep 17, 1 PM — quietSep 17, 3 PM — 1 piece · 1 post — Hacker News 1Sep 17, 5 PM — 2 pieces · 2 posts — Mastodon 2Sep 17, 7 PM — quietSep 17, 9 PM — quietSep 17, 11 PM — quietSep 18, 1 AM — quietSep 18, 3 AM — 1 piece · 1 post — Mastodon 1Sep 18, 5 AM — quietSep 18, 7 AM — quietSep 18, 9 AM — quietSep 18, 11 AM — quietSep 18, 1 PM — quietSep 18, 3 PM — quietSep 18, 5 PM — quietSep 18, 7 PM — quietSep 18, 9 PM — quietSep 18, 11 PM — quietSep 19, 1 AM — quietSep 19, 3 AM — quietSep 19, 5 AM — quietSep 19, 7 AM — quietSep 19, 9 AM — quietSep 19, 11 AM — quietSep 19, 1 PM — quietSep 19, 3 PM — quietSep 19, 5 PM — quietSep 19, 7 PM — quietSep 19, 9 PM — quietSep 19, 11 PM — quietSep 20, 1 AM — quietSep 20, 3 AM — quietSep 20, 5 AM — quietSep 20, 7 AM — quietSep 20, 9 AM — quietSep 20, 11 AM — quietSep 20, 1 PM — quietSep 20, 3 PM — quietSep 20, 5 PM — quietSep 20, 7 PM — quietSep 20, 9 PM — quietSep 20, 11 PM — quietSep 21, 1 AM — quietSep 21, 3 AM — quietSep 21, 5 AM — quietSep 21, 7 AM — quietSep 21, 9 AM — quietSep 21, 11 AM — quietSep 21, 1 PM — quietSep 21, 3 PM — quietSep 21, 5 PM — quietSep 21, 7 PM — quietSep 21, 9 PM — quietSep 21, 11 PM — quietSep 22, 1 AM — quietSep 22, 3 AM — quietSep 22, 5 AM — quietSep 22, 7 AM — quietSep 22, 9 AM — quietSep 22, 11 AM — quietSep 22, 1 PM — quietSep 22, 3 PM — quietSep 22, 5 PM — quietSep 22, 7 PM — quietSep 22, 9 PM — quietSep 22, 11 PM — quietYesterday, 1 AM — quietYesterday, 3 AM — quietYesterday, 5 AM — quietYesterday, 7 AM — quietYesterday, 9 AM — quietYesterday, 11 AM — quietYesterday, 1 PM — quietYesterday, 3 PM — quietYesterday, 5 PM — quietYesterday, 7 PM — quietYesterday, 9 PM — quietYesterday, 11 PM — quietToday, 1 AM — quietToday, 3 AM — quietToday, 5 AM — quietToday, 7 AM — quiet 1
Sep 17Sep 18Sep 19Sep 20Sep 21Sep 22yesterdaynow · 9:45 AM ET

What was reported 1 claim about this development

  1. first by Mastodon, 6d ago

What people said 4 voices · verbatim

All 1 developments of Brevo supply-chain attack injects ClickFix malware via… →

MastodonHacker News