Brevo supply-chain attack injected ClickFix scripts on customer sites
Summary
Brevo has confirmed a supply-chain attack where attackers stole a Cloudflare API key and injected malicious ClickFix scripts into their websites and customer-embedded JavaScript files. These scripts were used to distribute malware.
IFF Assessment
FOE
The article describes a successful supply-chain attack that led to malware distribution, posing a direct threat to defenders.
Defender Context
This incident highlights the critical importance of securing API keys and monitoring third-party script integrations, as supply-chain attacks continue to be a prevalent threat vector. Defenders should maintain vigilance over their software supply chain and implement robust monitoring for unexpected script modifications on their web assets.