Brevo Supply-Chain Attack Compromises 100,000+ Sites via Cloudflare
Malware injected through trusted infrastructure impacts major brands.
1Attack vector through trusted vendor
Attackers exploited a long-lived Cloudflare API key stored in Brevo's source code to deploy a malicious Worker. This allowed them to modify responses at the CDN edge without altering origin files, bypassing standard integrity checks. The Worker removed security headers like Content-Security-Policy, enabling malware injection while leaving origin servers untouched. Over 100,000 sites loading Brevo scripts were potentially affected.
2Two-stage compromise timeline
The breach began on September 10 when attackers accessed 138 accounts via SAML SSO vulnerability, exporting data from 43 accounts. Four days later, they used a stolen Cloudflare key to deploy malware. The active attack window lasted just over 4 hours (16:05-20:13 UTC on Sept 14). While Brevo revoked access by the 15th, the connection between these incidents remains unconfirmed.
3Dual malware components
The attack delivered different payloads: a fake 'human verification' prompt for regular visitors and a hidden WordPress plugin for administrators. The plugin ('Web Media Optimizer') could persist through must-use folders and communicate with C2 servers. It specifically targeted logged-in admins while evading detection from security scanners and crawlers.
4Supply-chain amplification
By compromising Brevo's infrastructure, attackers gained access to all sites using its scripts without individual breaches. The company's chat widget and tracking scripts, loaded by thousands of sites, were modified to pull malicious code from a legitimate Brevo domain (sendibt1.com). This abuse of trust relationships characterizes modern supply-chain attacks.
5Enterprise impact
Brevo's client roster includes major brands like eBay, Louis Vuitton and Michelin. The malware could have affected any site using Brevo's services during the exposure window. Security firm Sansec estimates over 100,000 sites may have served malware, including Brevo's own domain on September 14.
6Detection challenges
The attack remained invisible to standard monitoring tools because it operated exclusively at the CDN edge. File hashes and origin server checks showed no anomalies since the origin content was never modified. This highlights the need for multi-layer security monitoring beyond traditional integrity checks.
7Remediation steps
Brevo revoked the compromised key, removed hardcoded credentials, deleted attacker hostnames, and flushed edge caches. Affected sites should check for plugin installations around September 14, compare disk contents with admin views (the malware hides from plugin lists), and rotate admin passwords. Machines where verification commands were executed need thorough scanning.
8Broader security implications
This incident demonstrates how supply-chain attacks leverage trusted vendor relationships for mass distribution. A single compromised API key enabled malware delivery to thousands of sites. The attack's success relied on common weaknesses: hardcoded credentials, excessive permissions, and insufficient edge security monitoring - patterns seen across similar breaches.