100k Websites Were Serving Malware and Had No Idea. A popular marketing tool has been compromised by hackers and turned into a weapon against 100,000 websites and their visitors. Could your website be next?
Brevo, previously known as Sendinblue, is a popular service used by companies of all sizes to manage email marketing and customer communications. From eBay to Louis Vuitton, countless companies use Brevo to stay in touch with their customers. Many brands use Brevo’s widgets directly in their pages e.g. chat boxes and signup forms. This means their integration goes deep. Therefore, once Brevo’s servers were hacked, it opened up a whole world of data to the attackers.
A Silent Attack With a Massive Reach
The attack took place on September 14 and was remarkably short-lived, being live for just over four hours. However, this small window of opportunity allowed the hackers to cause major damage. The attackers had somehow gained access to a Brevo Cloudflare API Key. This allowed them to alter files that Brevo’s customers were loading onto their own websites. These customers, of course, were completely unaware that anything had changed.
Depending on who was visiting the website, the attack used two different tricks. Regular visitors were served a fake “verify you are human” page. Rather than consisting of a normal CAPTCHA, this malicious one told visitors to copy and paste a command directly into their PC. This is known as the ClickFix social engineering technique. Following this fake command would lead to malware being installed.
If a website visitor was logged into WordPress as an administrator, the attack became more targeted. The hijacked script tried to install a malicious plugin through the admin’s active session. This resulted in a permanent backdoor being installed. The hackers could then access that website remotely for as long as they wanted, with little chance of being detected.
Staying Safe From Similar Attacks
What’s most troubling about this campaign is that there was very little the victims could have done to avoid visiting an infected website. Nonetheless, Ophtek has your back, and that’s why we’re going to share some practical tips for staying safe:
- Be Suspicious of Online Prompts: If you’re ever asked to verify you are human, this should only require you to complete a simple task e.g. completing a CAPTCHA. If, instead, you’re asked to do something more complex and unusual, you should be suspicious. Installing files or copying and pasting code should always be a major red flag.
- Check Your Plugins: If you run a WordPress website, log in to your dashboard and verify all of your plugins. If something looks unfamiliar, or wasn’t installed by you, remove it. This can quickly eliminate any threat and give you time to run a full security scan.
- Always Update Your Software and Security: One of the simplest ways to stay safe online is by keeping your software updated. This reduces the risk of zero-day vulnerabilities being exploited and protects you against the latest threats.
For more ways to secure and optimize your business technology, contact your local IT professionals.
