Brevo Supply-Chain Attack Infected Over 100,000 Websites

A Brevo supply-chain attack used compromised Cloudflare access to inject malware into websites, potentially affecting over 100,000 sites.

Brevo, formerly known as Sendinblue, is a French cloud-based marketing and customer communication platform whose clients include eBay, Louis Vuitton and Michelin.

The company was first compromised on September 10, when attackers exploited a vulnerability in its SAML SSO system and gained access to 138 accounts, including one belonging to cryptocurrency hardware wallet maker Trezor. Six accounts were used to send phishing emails, while contact data was exported from 43 accounts.

Brevo blocked the unauthorized access, but attackers returned four days later using a compromised, long-lived Cloudflare API key. They used the key to deploy a malicious Cloudflare Worker that injected code into Brevo’s websites and three JavaScript files embedded in customer sites.

“A long-lived Cloudflare API key with full account permissions was stored in application source code and was obtained by the attacker. With it, they could create Workers, routes and DNS records on Brevo’s zones without triggering an alert.” reads a Brevo’s notice of incident. “Because the Worker rewrote responses at the edge and removed security headers such as Content-Security-Policy, our origin servers and files remained unmodified and standard integrity checks did not detect the change.”

This turned Brevo’s trusted infrastructure into a malware distribution channel. The malicious code was served to visitors and users of websites relying on Brevo’s services. Security firm Sansec estimated that more than 100,000 sites may have been affected. Unlike the initial incident, this was no longer just a breach of customer accounts: the vendor’s own infrastructure had become the mechanism for distributing the attack.

“On 14 September, Brevo served malware to visitors of its own site and more than 100 thousand customer sites.” cybersecruity firm Sansec reports. “The malware had two components:

• a malicious WordPress plugin, installed when site admins visited their own site
• a clickfix overlay, shown to everyone browsing a customer site or clicking an (unsubscribe) link in a Brevo-sent campaign email”

Brevo’s chat widget and tracking scripts, loaded directly from cdn.brevo.com by thousands of websites, were modified to load an additional script from sendibt1.com, a domain owned by Brevo. This meant attackers could reach a large number of sites without compromising them individually.

Visitors were shown a fake “prove you’re human” prompt designed to trick them into running a malicious command. WordPress administrators faced a more serious threat: if they were logged in while visiting their site, a malicious plugin could be installed through their active session without requiring a password.

The malware also tried to avoid detection by targeting only logged-in WordPress admins and ignoring crawlers, developers and security scanners. BleepingComputer later found the plugin on VirusTotal disguised as “Web Media Optimizer.” It could hide from the normal plugin list, persist through the must-use plugins folder and communicate with its command-and-control server.

The files on Brevo’s servers were completely clean the entire time. Anyone checking file hashes or running standard integrity monitoring on the origin would have found nothing wrong, because nothing on the origin ever changed. The attack lived entirely at the CDN edge, invisible to any tool watching the wrong layer.

Sansec says supply-chain attacks offer attackers enormous reach. In this case, a single stolen key and compromised Cloudflare access allowed malware to spread through Brevo’s trusted infrastructure to websites using its scripts. Attackers did not need to compromise each customer or trick every victim individually. The trust was already built into the websites through a simple <script> tag, making the vendor a powerful distribution point for the attack.

The exposure window ran from roughly 16:05 to 20:13 UTC on September 14th, and both companies agree everything was clean again by the 15th. Brevo revoked the compromised key, pulled the hardcoded credential out of its source code, deleted the attacker’s hostnames, and flushed its edge caches. Whether this Cloudflare compromise connects back to the SSO-related account hijacking Brevo disclosed on September 10th, the one that led to phishing emails reaching 347,000 addresses tied to crypto wallet vendor Trezor, is still an open question Brevo hasn’t answered.

If you run a Brevo widget, a form, or the chat script on your site, don’t take “we fixed it” as the end of the story. Check your access logs for a plugin install or activation around September 14th, compare what’s on disk against what the WordPress admin screen actually shows (this plugin specifically hides itself from that list), and rotate admin passwords if you find anything. And if anyone on your team pasted a “verification” command into their terminal that day because a website told them to, that machine needs a proper scan, not just a shrug.

Ironically, sendibt1.com is probably the domain many people would want to block. But that would cause problems because it is a legitimate Brevo domain used for email tracking. Blocking it could break open and click tracking for customers still using the service. The attackers simply abused infrastructure that was already trusted.

Sansec’s report includes indicators of compromise, C2 paths, and file hashes.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, supply chain)