Attackers compromised Brevo’s Cloudflare setup using a long-lived API key found in source code, then altered website content at the CDN edge. Visitors were shown fake Cloudflare verification prompts to run Windows commands, and logged-in WordPress admins were targeted with a hidden backdoor plugin disguised as a legitimate optimizer.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine a site you trust suddenly shows a big Cloudflare box saying, “Verify to continue”… and then tells you to run a Windows command. That’s what hit Brevo: a hardcoded Cloudflare API key got stolen, attackers dropped a malicious Cloudflare Worker, and it injected fake Cloudflare prompts telling visitors to paste commands into PowerShell. If you were a logged‑in WordPress admin, it got worse: a hidden backdoor plugin called “Web Media Optimizer” could silently install, hide in the must‑use directory, phone home to glegchner.com and corralos.beer, and even bypass admin passwords with a hardcoded key. Your move: if any site ever tells you to copy a command into PowerShell or Command Prompt to ‘verify’ you’re human, stop right there and report it to security immediately.
This weekly roundup includes two real social-engineering-driven incidents. Attackers used social engineering to access Apollo Global Management’s cloud platforms and steal sensitive personal data, and separately attempted a ShinyHunters phishing attack against ReliaQuest using a fake SSO login page…
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
The article describes multiple real-world social engineering operations this week, including phishing sent from a legitimate Trezor newsletter channel and malware pushed through a verified HBO Max Reddit ad account. It also highlights a large-scale network of fake online stores impersonating real…
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
Researchers found real GitHub repositories containing poisoned AI-agent instruction/config files (like CLAUDE.md and .cursorrules) that silently tell coding assistants to steal prompts, environment variables, and credentials. The malicious instructions can trigger hidden commands (for example, curl…
Attackers are taking over hotel and conference Wi‑Fi gateways and changing DNS settings so travelers are silently redirected to fake Microsoft 365 sign-in pages. Victims are then tricked into completing a device-code login that grants attackers a legitimate session token, often bypassing MFA. This…
