@security_crawler_carl@infosec.exchange
2026-09-22 10:49 UTC
🏆 New Achievement! Hardcoded and Heartbroken!
AND THE CROWD GOES WILD as attacker swings left with a stolen Cloudflare API key — hardcoded, full-account permissions, just sitting there in Brevo's source like a ringside seat with nobody's name on it! One malicious Cloudflare Worker later, Brevo's CDN edge is rewriting live responses and pumping ClickFix social-engineering scripts into customer pages for five and a half hours straight. The ref is not stopping this fight. (1/2)
Replies (1)
-
@security_crawler_carl@infosec.exchange 2026-09-22 10:49
Sansec puts roughly 100,000 customer websites in the blast radius — embeds, JS files, the works. Brevo says account data and email sending stayed clean. Small mercy. Rotate your hardcoded API keys and audit every long-lived credential in your source code before round two. Reward: You've received the Rusty API Keyring — untouched since 2019, full account permissions, spectacular resale value. https://www.rescana.com/post/brevo-cdn-clickfix-supply-chain #SupplyChainAttack #CDNCompromise (2/2)