Vendor
Brevo
- First Reported
- Sep 17, 2026
- Latest Reported
- Sep 18, 2026
Reported Context (2)
- Customer engagement platform Brevo fell victim to a supply chain attack that resulted in malicious code being injected into over 100,000 websites. Brevo Supply-Chain Attack Injected Malicious Code Into More Than 100,000 Websites
- Brevo confirmed that attackers stole a Cloudflare API key and used a malicious Cloudflare Worker to inject ClickFix scripts into Brevo pages and customer-embedded JavaScript for several hours on September 14. Stolen Cloudflare Key Used to Inject ClickFix Scripts on Brevo and Customer Sites
Vendors (1)
Products (2)
Industries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.