Latest / The Digital Warfare Podcast
EP. 164: Brevo Supply Chain Attack Turns Trusted Websites Into Malware Delivery Points.
Summary
A Brevo supply chain security incident demonstrated how a single compromised privileged credential can create risk across multiple trusted websites.
Attackers obtained a long lived Cloudflare API key with extensive account permissions that Brevo said had been hardcoded in application source code. The credential was used to create a malicious Cloudflare Worker and manipulate content delivered through Brevo infrastructure.
The attack also affected JavaScript components embedded on customer websites, including Brevo forms, Conversations widgets and SDK loader scripts. Visitors could be…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.