Cybersecurity Nightmare Unfolds as Brevo Supply-Chain Attack Injects Malware on Customer Sites
A devastating supply-chain attack has rocked the cybersecurity world, with customer relationship management (CRM) company Brevo confirming that its systems were compromised by attackers. The malicious actors exploited a hardcoded Cloudflare API key to inject ClickFix scripts into Brevo’s websites and JavaScript files embedded on customer sites, distributing malware in the process.
The attack, which occurred on September 14, affected numerous pages on Brevo’s own website, as well as those of its customers who had integrated Brevo components into their sites. The compromised API key allowed attackers to create a malicious Cloudflare Worker that modified content at the CDN edge for approximately five and a half hours, completely evading security headers and checks.
Brevo has confirmed that the attack impacted pages on brevo.com, sendinblue.com, login/account/my/onboarding.brevo.com, and sibforms.com. The malicious scripts also targeted Brevo’s forms script, Conversations widget, and SDK loader scripts embedded on customers’ websites. These scripts are designed to modify content and interact with users in various ways.
According to Brevo’s post-mortem analysis, the attackers obtained a long-lived Cloudflare API key that had been hardcoded into application source code. This allowed them to create Cloudflare Workers, routes, and DNS records across Brevo’s zones without triggering an alert. The company has since removed the compromised Worker and its routes, revoked the tainted API key, and purged its edge caches.
The incident is significant not only because of the number of affected websites – up to 100,000, according to security firm Sansec – but also due to the severity of the attack. Visitors to these sites were shown a fake Cloudflare verification page followed by ClickFix instructions urging them to run a command on Windows. On WordPress sites embedding an affected Brevo widget, the script checked for administrator login and attempted to upload a malicious plugin.
While there is no evidence that customer account data or email delivery infrastructure was compromised, the attack highlights the risks associated with supply-chain vulnerabilities. Brevo has assured customers that its API, app.brevo.com, and email delivery infrastructure were not affected by the incident.
This latest breach follows on the heels of another significant security incident reported by Brevo in September, where attackers hijacked customer accounts and launched phishing attacks targeting companies using Brevo’s services. While Brevo has not confirmed whether the two incidents are connected, cybersecurity experts warn that such breaches underscore the importance of robust security measures and vigilance against emerging threats.
So what can website administrators take away from this incident? The most important takeaway is to remain vigilant about security updates and patches for integrated third-party components like Cloudflare Workers. Hardcoded credentials are a ticking time bomb waiting to unleash a supply-chain attack, so it’s essential to regularly review and remove such secrets from source code. Additionally, implementing robust monitoring tools and conducting regular security audits can help detect and mitigate the impact of similar attacks in the future.
Source: Bleeping Computer — 2026-09-17