Brevo Supply-Chain Attack Infected Over 100,000 Websites
Attackers with a stolen Cloudflare API key turned Brevo's CDN into a malware channel, injecting code into 100,000+ customer websites.
90
- Mentions · 7d0
- Mentions · 30d0
- All mentions11
- First seenSep 10, 2026
- Last mentionedSep 18, 2026
Timeline
11 articles · newest firstBrevo Supply Chain Attack Injects Malware Into 100,000 Websites
Attackers breached Brevo, hijacked a Cloudflare API key, and injected ClickFix malware scripts served to visitors of 100,000+ websites including Trezor.
78
Brevo Supply Chain Attack Pushes WordPress Backdoors and ClickFix Malware to 100,000+ Sites
A Brevo supply chain compromise served malicious JavaScript to 100,000+ sites, installing WordPress backdoors and pushing ClickFix commands to visitors.
74
Hackers Turn Brevo Widgets Into Malware Delivery Channel Across 100,000+ Websites
Attackers compromised Brevo-hosted JavaScript to deliver a WordPress backdoor and ClickFix payloads across 100,000+ websites, exposing visitors and admins.
82
Brevo supply-chain attack injected ClickFix scripts on customer sites
Attackers used a stolen Cloudflare API key to inject ClickFix malware-delivery scripts into Brevo sites and customer-embedded scripts for five hours.
80
Brevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malware
Attackers with Brevo DNS access injected malicious scripts serving ClickFix malware and WordPress backdoors to over 100,000 customer sites on 14 September 2026.
85
Crypto customers targeted by scammers after email marketing provider breach
Attackers exploited a Brevo SAML SSO flaw to access 138 accounts and phish crypto customers of Trezor, CoinTracking, and BitBox.
75
Scammers target hundreds of thousands of crypto owners after Trezor confirms data breach of email provider
Third-party breaches at Trezor's email and shipping vendors exposed customer data, fueling phishing campaigns targeting hundreds of thousands of crypto wallet owners.
62
Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack
Attackers abused Brevo's SAML SSO to access 138 accounts, sending phishing emails to 347,000 Trezor customers and exfiltrating contacts from 43 accounts.
65
Trezor: 347,000 users targeted in phishing attacks after Brevo breach
Trezor reported phishing after the Brevo breach targeted 347,000 newsletter subscribers, with 2,500 users clicking before the domain was taken down.
65
Multiple crypto companies warn customers of phishing emails after alleged provider breach
Attackers compromised 120 Brevo email accounts and sent convincing phishing emails to Trezor, BitBox, and CoinTracking newsletter subscribers.
55
Appears with
- Cloudflarevendor · 6
- Brevoorganization · 6
- Trezororganization · 6
- Sansecvendor · 5
- Trezorvendor · 5
- Trezorvictim · 5
- WordPressproduct · 5
- Brevovictim · 3
- Sansecorganization · 3
- ShipMonkvendor · 3
- BitBoxvictim · 2
- Brevo Conversationsproduct · 2
- Trezor customersvictim · 2
- CoinTrackingorganization · 2
- BitBoxvendor · 2
- CoinTrackingvictim · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.