Brevo Supply Chain Attack Exposed 100,000 Websites to Malware

A supply-chain attack targeting Brevo, the French marketing and customer communications platform formerly known as Sendinblue, may have exposed more than 100,000 websites to malware, according to security firm Sansec. Attackers initially compromised Brevo on 10 September by exploiting a vulnerability in its SAML single sign-on system, accessing 138 accounts. Six were used to send phishing emails, while data was exported from 43 accounts.

After Brevo blocked that access, the attackers returned four days later using a long-lived Cloudflare API key with full permissions that had been stored in application source code.

The key allowed them to create a malicious Cloudflare Worker, routes and DNS records. Although Brevo’s origin servers and files remained clean, the Worker modified responses at the CDN edge and altered JavaScript served through `cdn.brevo.com`, including scripts embedded in customer websites. Between approximately 16:05 and 20:13 UTC on 14 September, visitors were shown a fake “prove you’re human” prompt intended to make them run a malicious command.

Logged-in WordPress administrators could instead receive a concealed malicious plugin, identified on VirusTotal as “Web Media Optimizer”, which could persist and communicate with a command-and-control server. Brevo said the service was clean again by 15 September after revoking the key, removing the credential, deleting attacker hostnames and flushing edge caches.

Site operators using Brevo widgets, forms or chat scripts should review access logs and WordPress files for unexpected plugin installation or activation around 14 September. Sansec’s report contains indicators of compromise, including hashes and command-and-control paths. The article says it remains unclear whether the Cloudflare compromise was connected to the earlier SSO incident, which led to phishing emails reaching 347,000 addresses associated with Trezor.