A supply-chain attack targeting Brevo, a French cloud-based marketing and customer communication platform, led to the injection of malicious code into its own websites and those of over 100,000 customers. The incident, which began on September 10, involved attackers exploiting a vulnerability in Brevo's SAML single sign-on (SSO) system.
Initially, this compromise allowed unauthorized access to 138 Brevo accounts, including one belonging to the cryptocurrency hardware wallet manufacturer Trezor. Attackers used six of these accounts to dispatch phishing emails and exported contact data from 43 accounts. Brevo stated it blocked this access, but the threat actors returned four days later.
On September 14, attackers leveraged a compromised, long-lived Cloudflare API key to deploy a malicious Cloudflare Worker. This Worker injected code into Brevo's websites and three JavaScript files embedded in customer sites. Brevo confirmed that the API key, which had full account permissions, was stored in its application source code. The Worker operated at the CDN edge, rewriting responses and removing security headers like Content-Security-Policy, meaning Brevo's origin servers and files remained unaltered and standard integrity checks failed to detect the change.
Security firm Sansec estimated that more than 100,000 websites were affected by this second phase of the attack. The malicious code was served to visitors of Brevo's own site and its customers' sites through modified chat widgets and tracking scripts loaded from cdn.brevo.com, which were altered to load an additional script from sendibt1.com—a legitimate Brevo domain.
The malware had two primary components. For general website visitors and users clicking unsubscribe links in Brevo-sent campaign emails, a "clickfix overlay" was displayed, presenting a fake "prove you're human" prompt designed to trick them into executing a malicious command.
WordPress administrators faced a more severe threat. If logged in while visiting their site, a malicious plugin could be installed through their active session without requiring a password. This plugin, later found on VirusTotal disguised as "Web Media Optimizer," was designed to hide from the normal plugin list, persist through the must-use plugins folder, and communicate with its command-and-control server. It also attempted to evade detection by targeting only logged-in WordPress admins and ignoring crawlers, developers, and security scanners.
The exposure window for this supply-chain attack ran from approximately 16:05 to 20:13 UTC on September 14. Brevo reported that by September 15, the compromised key had been revoked, the hardcoded credential removed from its source code, attacker-created hostnames deleted, and edge caches flushed.
Brevo has not yet confirmed whether the Cloudflare compromise is directly linked to the initial SSO-related account hijacking on September 10, which led to phishing emails reaching 347,000 addresses associated with Trezor.
Website administrators who use Brevo widgets, forms, or chat scripts are advised to check their access logs for any plugin installations or activations around September 14. They should also compare their disk files against what the WordPress admin screen shows, as the malicious plugin specifically hid itself from that list, and rotate admin passwords if any anomalies are found. Additionally, any team members who executed verification commands in their terminal on that day, prompted by a website, should have their machines thoroughly scanned.
