Massive supply chain attack via Brevo: Over 100,000 WordPress sites affected
An attacker managed to gain access to the marketing platform Brevo by exploiting a residual Cloudflare API key left in the source code.
This was used to deploy a malicious Cloudflare Worker that installed harmful scripts and a backdoor plugin on tens of thousands of WordPress sites.
Visitors to the affected websites were subsequently presented with deceptive fake verification screens.
The attack does not only affect Brevo itself but also compromises the websites of unsuspecting end users on a massive scale.
This serious incident underscores how extremely dangerous hardcoded credentials in production environments can be for an entire supply chain.
Read the sansec.io article for more information.