Brevo Supply-Chain Attack: The Edge Worker That Poisoned 100,000 Customer Websites From a Hardcoded API Key
A single hardcoded Cloudflare API key sitting inside Brevo’s own source code let attackers rewrite what thousands of customer websites served to visitors, without touching a single origin server. The marketing-platform company confirmed on September 17 that attackers used the stolen key to create a malicious Cloudflare Worker and inject ClickFix scripts into brevo.com, sendinblue.com,…