Brevo Supply-Chain Attack Infected Over 100,000 Websites
Attackers with a stolen Cloudflare API key turned Brevo's CDN into a malware channel, injecting code into 100,000+ customer websites.
Attackers first compromised Brevo (formerly Sendinblue) on September 10 via its SAML SSO system, accessing 138 accounts and exporting contact data from 43; phishing emails reached about 347,000 addresses, many tied to hardware wallet maker Trezor. On September 14, they used a long-lived Cloudflare API key hardcoded in Brevo's source code to deploy a malicious Cloudflare Worker that rewrote responses at the edge, stripped Content-Security-Policy headers, and injected scripts from sendibt1.com into Brevo's widgets and tracking JavaScript. Visitors saw a fake 'prove you're human' prompt (ClickFix-style command execution), while logged-in WordPress admins had a hidden plugin disguised as 'Web Media Optimizer' installed through their active sessions. Sansec estimated over 100,000 sites were exposed during the roughly four-hour window on September 14 before Brevo revoked the key and flushed caches.
- SAML SSO flaw gave attackers access to 138 Brevo accounts on September 10, including Trezor's
- Long-lived Cloudflare API key with full account permissions was stored in application source code
- Malicious Worker rewrote responses at the CDN edge and removed CSP headers, evading origin integrity checks
- ClickFix overlay and hidden WordPress plugin 'Web Media Optimizer' targeted visitors and logged-in admins
- Exposure window 16:05-20:13 UTC on September 14; key revoked, hostnames deleted, caches flushed
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1552.001 Credentials In FilesT1078.004 Cloud AccountsT1059.004 Unix Shell
- Malware
- Web Media Optimizer
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | sendibt1.com | machine needs a proper scan, not just a shrug. Ironically, sendibt1.com is probably the domain many people would want to block. But |
From the original article
4 min read at securityaffairs.com
A Brevo supply-chain attack used compromised Cloudflare access to inject malware into websites, potentially affecting over 100,000 sites. Brevo, formerly known as Sendinblue, is a French cloud-based marketing and customer communication platform whose clients include eBay, Louis Vuitton and Michelin. The company was first compromised on September 10, when attackers exploited a vulnerability in its […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.