INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Brevo Supply-Chain Attack Infected Over 100,000 Websites Worldwide

| 2026-09-21 23:13 CRITICAL HIGH DATA BREACH SUPPLY CHAIN
JSON
Executive Summary
AI-generated
On September 21, 2026, a data breach occurred at Japan's Digital Agency after attackers exploited a vulnerability in a VPN appliance, exposing approximately 246,000 records including names and contact details of government officials and contractors. Two oil tankers bound for Texas were hit by cyberattacks that disrupted onboard systems during voyages to the United States, with malicious activity confirmed on one vessel but not attributed to a specific actor. A supply chain attack affected about 100,000 websites after attackers used a compromised Cloudflare API key to inject malicious scripts into Brevo customer communication and marketing platforms. Meanwhile, Japanese software company Helpfeel reported a data breach exposing over 23 million user records and 490 million image metadata records following an exploitation of vulnerabilities in its image upload server.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2026-76460, CVE-2026-91843 and treat internet-facing systems that were not patched in time as potentially compromised until verified. • Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. • Restrict Web-Based Content (ATT&CK mitigation for Phishing): Determine if certain websites or attachment types (ex: .scr, .exe, .pif, .cpl, etc.) that can be used for phishing are necessary for business operations and consider bloc • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 2 IoCs Create Free Account
se•••••.com
cd•••••.com
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Contagious InterviewContagious Interview CVE-2026-76460CVE-2026-76460 CVE-2026-91843CVE-2026-91843 CVE-2026-77692CVE-2026-77692 CVE-2026-76461CVE-2026-76461
Target & Sectors
LATAM LATAM NORTH_AMERICA NORTH_AMERICA governmentgovernment cryptocurrencycryptocurrency technologytechnology maritimemaritime
Incident Timeline
‎December 2025
Threat actors impersonated AI or blockchain employers to steal funds and credentials from over 7,000 cryptocurrency wallets between December 2025 and July 2026.
general_metric 7,000 cryptocurrency wallets
Operators posed as AI or blockchain employers, targeting IT professionals and stealing funds or credentials from over 7,000 cryptocurrency wallets from December 2025 through July 2026.
‎July 2026
Threat actors used GhostCode and HEAVYGRAM to target Microsoft 365 accounts, while also targeting cryptocurrency wallets and government entities across Latin America through the FamousSparrow campaign.
general_metric 7,000 cryptocurrency wallets
Operators posed as AI or blockchain employers, targeting IT professionals and stealing funds or credentials from over 7,000 cryptocurrency wallets from December 2025 through July 2026.
organisation FamousSparrow
Researchers outlined a China-aligned FamousSparrow espionage campaign targeting government entities across Latin America and a telecommunications organization in Puerto Rico.
organisation SparroWocky
The group deployed a new backdoor called SparroWocky, replacing its long-running SparrowDoor implant and supporting persistent surveillance across victims in Latin America.
organisation SparrowDoor
The group deployed a new backdoor called SparroWocky, replacing its long-running SparrowDoor implant and supporting persistent surveillance across victims in Latin America.
infrastructure Microsoft 365
Researchers identified GhostCode, a device-code phishing kit that targets Microsoft 365 accounts by abusing the legitimate OAuth 2.0 device authorization flow.
organisation Microsoft
Researchers identified GhostCode, a device-code phishing kit that targets Microsoft 365 accounts by abusing the legitimate OAuth 2.0 device authorization flow.
infrastructure 2.0 device
Researchers identified GhostCode, a device-code phishing kit that targets Microsoft 365 accounts by abusing the legitimate OAuth 2.0 device authorization flow.
infrastructure Windows
Researchers revealed HEAVYGRAM, a Windows surveillance backdoor linked with moderate confidence to the Iranian Handala group.
organisation Telegram
Active since 2023 against Iranian dissidents and journalists, the malware uses Telegram for command and control and can execute commands, capture screenshots, steal Telegram session data, exfiltrate files, and maintain persistence.
organisation MFA
Victims authenticate through Microsoft, allowing attackers to capture tokens, register attacker-controlled devices, and obtain persistent account access without stealing the victim’s password or directly bypassing MFA.
‎September 10th
Threat actors used phishing emails to reach 347,000 addresses tied to crypto wallet vendor Trezor.
tactic Phishing
Whether this Cloudflare compromise connects back to the SSO-related account hijacking Brevo disclosed on September 10th, the one that led to phishing emails reaching 347,000 addresses tied to crypto wallet vendor Trezor, is still an open question Brevo hasn’t answered.
organisation SSO
Whether this Cloudflare compromise connects back to the SSO-related account hijacking Brevo disclosed on September 10th, the one that led to phishing emails reaching 347,000 addresses tied to crypto wallet vendor Trezor, is still an open question Brevo hasn’t answered.
general_metric 347,000 addresses
Whether this Cloudflare compromise connects back to the SSO-related account hijacking Brevo disclosed on September 10th, the one that led to phishing emails reaching 347,000 addresses tied to crypto wallet vendor Trezor, is still an open question Brevo hasn’t answered.
‎September 10
Threat actors exploited a vulnerability in Trezor's SAML SSO system on September 10 to gain access to 138 accounts.
organisation Trezor
The company was first compromised on September 10, when attackers exploited a vulnerability in its SAML SSO system and gained access to 138 accounts, including one belonging to cryptocurrency hardware wallet maker Trezor.
general_metric 138 accounts
The company was first compromised on September 10, when attackers exploited a vulnerability in its SAML SSO system and gained access to 138 accounts, including one belonging to cryptocurrency hardware wallet maker Trezor.
‎September 2026
Oracle released its September 2026 Critical Security Patch Update addressing more than 800 vulnerabilities across 17 product families.
organisation Oracle
Oracle has released its September 2026 Critical Security Patch Update, addressing more than 800 vulnerabilities across 17 product families.
general_metric 800 vulnerabilities
Oracle has released its September 2026 Critical Security Patch Update, addressing more than 800 vulnerabilities across 17 product families.
general_metric 17 product families
Oracle has released its September 2026 Critical Security Patch Update, addressing more than 800 vulnerabilities across 17 product families.
threat_actor Contagious Interview
THREAT INTELLIGENCE REPORTS US, Japanese, Australian, and German authorities warned about WaterPlum (Contagious Interview), a North Korea-linked campaign that infected at least 30,000 devices across more than 100 countries.
infrastructure 30,000 devices
THREAT INTELLIGENCE REPORTS US, Japanese, Australian, and German authorities warned about WaterPlum (Contagious Interview), a North Korea-linked campaign that infected at least 30,000 devices across more than 100 countries.
organisation CVE-2026-77692
One issue, CVE-2026-77692, allows an unauthenticated remote attacker to crash the named process with a single crafted DNS-over-HTTPS request.
organisation DNS
One issue, CVE-2026-77692, allows an unauthenticated remote attacker to crash the named process with a single crafted DNS-over-HTTPS request.
infrastructure 9.21.26
Versions 9.21.26 and 9.20.29 contain the fixes.
infrastructure 9.20.29
Versions 9.21.26 and 9.20.29 contain the fixes.
organisation Fusion Middleware
Affected products include E-Business Suite, Fusion Middleware, Hyperion, Siebel CRM, Analytics, Communications, and Virtualization.
organisation Hyperion
Affected products include E-Business Suite, Fusion Middleware, Hyperion, Siebel CRM, Analytics, Communications, and Virtualization.
organisation Analytics, Communications
Affected products include E-Business Suite, Fusion Middleware, Hyperion, Siebel CRM, Analytics, Communications, and Virtualization.
organisation ISC
ISC has published security updates for BIND 9 addressing 14 vulnerabilities, including seven high-severity flaws that can trigger denial-of-service conditions.
organisation BIND
ISC has published security updates for BIND 9 addressing 14 vulnerabilities, including seven high-severity flaws that can trigger denial-of-service conditions.
‎14 September
Threat actors used malware served by Brevo on its own site to target over 100,000 customer sites.
victims 100 customer sites
“On 14 September, Brevo served malware to visitors of its own site and  more than 100 thousand  customer sites.”
‎September 14th
Threat actors exploited a vulnerability in a plugin, creating an exposure window from 16:05 to 20:13 UTC on September 14th.
organisation UTC
The exposure window ran from roughly 16:05 to 20:13 UTC on September 14th, and both companies agree everything was clean again by the 15th.
‎September 18, 2026
Threat actors exploited compromised Cloudflare access to inject malware into websites, infecting over 100,000 sites.
industry Government
General Document Context
industry Maritime
General Document Context
industry Cryptocurrency
General Document Context
industry Technology
General Document Context
general_metric 100,000 websites
Brevo Supply-Chain Attack Infected Over 100,000 Websites Pierluigi Paganini September 18, 2026 A Brevo supply-chain attack used compromised Cloudflare access to inject malware into websites, potentially affecting over 100,000 sites.
organisation Brevo
Brevo Supply-Chain Attack Infected Over 100,000 Websites Pierluigi Paganini September 18, 2026 A Brevo supply-chain attack used compromised Cloudflare access to inject malware into websites, potentially affecting over 100,000 sites.
organisation Cloudflare
Brevo Supply-Chain Attack Infected Over 100,000 Websites Pierluigi Paganini September 18, 2026 A Brevo supply-chain attack used compromised Cloudflare access to inject malware into websites, potentially affecting over 100,000 sites.
data_breach 100,000 Paganini September
Brevo Supply-Chain Attack Infected Over 100,000 Websites Pierluigi Paganini September 18, 2026 A Brevo supply-chain attack used compromised Cloudflare access to inject malware into websites, potentially affecting over 100,000 sites.
‎21st September
Threat actors published a threat intelligence report on 21st September.
‎the week of 21st September
Threat actors released a Threat Intelligence Bulletin for the week of 21st September.
‎2026/09/21
Attackers exploited a vulnerability in an image upload server to breach Helpfeel's Gyazo service, exposing over 246,000 records including names and contact details of government officials and contractors.
organisation Digital Agency
TOP ATTACKS AND BREACHES Japan’s Digital Agency, which operates the Government Solution Service used by multiple ministries, has confirmed a data breach after attackers exploited a vulnerability in a VPN appliance.
organisation Helpfeel
Japanese software company Helpfeel, operator of image-sharing service Gyazo, has reported a data breach after attackers exploited a vulnerability in an image upload server.
organisation US Coast Guard
US Coast Guard and FBI personnel boarded the vessels, while officials confirmed malicious cyber activity on the VL Prosperity but have not publicly attributed the attacks to a specific actor.
organisation VL Prosperity
US Coast Guard and FBI personnel boarded the vessels, while officials confirmed malicious cyber activity on the VL Prosperity but have not publicly attributed the attacks to a specific actor.
organisation Security Management
The technique affected several AI-enabled browsers and assistants, enabling actions such as file access, screenshots, microphone and camera use, and logged-in activity before vendors issued security fixes. VULNERABILITIES AND PATCHES Check Point has released a fix for CVE-2026-91843, a critical vulnerability affecting Security Management and Log Servers.
organisation R80
The flaw, rated CVSS 9.8, stems from a stack overflow in the login process and can allow unauthenticated remote attackers to execute code as root on affected R80 through R82 systems.
organisation R82
The flaw, rated CVSS 9.8, stems from a stack overflow in the login process and can allow unauthenticated remote attackers to execute code as root on affected R80 through R82 systems.
organisation CVE-2026-76460 & CVE-2026-76461
Cisco has addressed CVE-2026-76460 & CVE-2026-76461 , two critical vulnerabilities affecting Cisco ISE and Secure Email Gateway with CVSS scores of 10.0 and 9.8.
organisation Cisco ISE
Cisco has addressed CVE-2026-76460 & CVE-2026-76461 , two critical vulnerabilities affecting Cisco ISE and Secure Email Gateway with CVSS scores of 10.0 and 9.8.
organisation CVSS
Cisco has addressed CVE-2026-76460 & CVE-2026-76461 , two critical vulnerabilities affecting Cisco ISE and Secure Email Gateway with CVSS scores of 10.0 and 9.8.
organisation CVE-2026-76460
According to Cisco, the company is aware of active exploitation of CVE-2026-76460, which allows an unauthenticated remote attacker to gain access to the system’s management interface.
organisation DNS
With it, they could create Workers, routes and DNS records on Brevo’s zones without triggering an alert.”
organisation Workers
With it, they could create Workers, routes and DNS records on Brevo’s zones without triggering an alert.”
organisation Brevo’s
With it, they could create Workers, routes and DNS records on Brevo’s zones without triggering an alert.”
organisation ClickFix
Brevo, a French customer communication and marketing platform, has confirmed a supply chain attack after attackers used a compromised Cloudflare API key to inject malicious ClickFix scripts into websites that use Brevo components.
organisation Sendinblue
Brevo, formerly known as Sendinblue, is a French cloud-based marketing and customer communication platform whose clients include eBay, Louis Vuitton and Michelin.
organisation eBay
Brevo, formerly known as Sendinblue, is a French cloud-based marketing and customer communication platform whose clients include eBay, Louis Vuitton and Michelin.
organisation Michelin
Brevo, formerly known as Sendinblue, is a French cloud-based marketing and customer communication platform whose clients include eBay, Louis Vuitton and Michelin.
organisation Check Point Research
AI THREATS Check Point Research has analyzed the July-August AI threat landscape, highlighting the latest cases when AI models broke out of their evaluation environments.
data_breach 246,000 records
Approximately 246,000 records were exposed, including names and contact details belonging to government officials and contractors, while financial information was not affected.
organisation Brevo Supply-Chain Attack Infected
Brevo Supply-Chain Attack Infected Over 100,000 Websites.
organisation Sansec
Security firm Sansec estimated that more than 100,000 sites may have been affected.
data_breach 23 user records
Above 23 million user records and 490 million image metadata records were exposed, including email addresses, password hashes, session IDs, integration tokens, and location metadata.
data_breach 490 metadata records
Above 23 million user records and 490 million image metadata records were exposed, including email addresses, password hashes, session IDs, integration tokens, and location metadata.
organisation VirusTotal
BleepingComputer later found the plugin on VirusTotal disguised as “Web Media Optimizer.”
organisation sendibt1.com
Ironically, sendibt1.com is probably the domain many people would want to block.
organisation Cloudflare Worker
They used the key to deploy a malicious Cloudflare Worker that injected code into Brevo’s websites and three JavaScript files embedded in customer sites.
organisation Content-Security-Policy
“Because the Worker rewrote responses at the edge and removed security headers such as Content-Security-Policy, our origin servers and files remained unmodified and standard integrity checks did not detect the change.”
organisation WordPress
WordPress administrators faced a more serious threat: if they were logged in while visiting their site, a malicious plugin could be installed through their active session without requiring a password.
organisation CDN
The attack lived entirely at the CDN edge, invisible to any tool watching the wrong layer.
organisation Sansec’s
Sansec’s report includes indicators of compromise, C2 paths, and file hashes.
organisation SecurityAffairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, supply chain)
Tactical Metrics
Metrics
infrastructure
30,000
Devices
THREAT INTELLIGENCE REPORTS US, Japanese, Australian, and German authorities warned about WaterPlum (Contagious Interview), a North Korea-linked campaign that infected at least 30,000 devices across more than 100 countries.
Metrics
infrastructure
‎Microsoft 365
Affected Product
Researchers identified GhostCode, a device-code phishing kit that targets Microsoft 365 accounts by abusing the legitimate OAuth 2.0 device authorization flow.
Metrics
infrastructure
2
Device
Researchers identified GhostCode, a device-code phishing kit that targets Microsoft 365 accounts by abusing the legitimate OAuth 2.0 device authorization flow.
Metrics
infrastructure
‎9.21.26
Software Version
Versions 9.21.26 and 9.20.29 contain the fixes.
Metrics
infrastructure
‎9.20.29
Software Version
Versions 9.21.26 and 9.20.29 contain the fixes.
Metrics
infrastructure
‎Windows
Affected Product
Researchers revealed HEAVYGRAM, a Windows surveillance backdoor linked with moderate confidence to the Iranian Handala group.
Metrics
data_breach
246,000
Records
Approximately 246,000 records were exposed, including names and contact details belonging to government officials and contractors, while financial information was not affected.
Metrics
data_breach
23,000,000
User Records
Above 23 million user records and 490 million image metadata records were exposed, including email addresses, password hashes, session IDs, integration tokens, and location metadata.
Metrics
data_breach
490,000,000
Metadata Records
Above 23 million user records and 490 million image metadata records were exposed, including email addresses, password hashes, session IDs, integration tokens, and location metadata.
Metrics
data_breach
100,000
Paganini September
Brevo Supply-Chain Attack Infected Over 100,000 Websites Pierluigi Paganini September 18, 2026 A Brevo supply-chain attack used compromised Cloudflare access to inject malware into websites, potentially affecting over 100,000 sites.
Metrics
victims
100,000
Customer Sites
“On 14 September, Brevo served malware to visitors of its own site and  more than 100 thousand  customer sites.”
Intelligence Sources
Security Affairs 2026-09-18
Check Point Research 2026-09-21