Brevo supply-chain attack: a stolen Cloudflare key infected customer sites

Brevo, a company that provides CRM and digital marketing services, has confirmed an incident in which attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts. The infection hit both Brevo's own websites and the JavaScript files of the widgets that customers embed on their pages.

How it worked

According to the breakdown published by the company itself, the attackers obtained a long-lived key with full permissions over the account — one that was hardcoded right into the application's source code. With it, they were able to create a malicious Cloudflare Worker that, over roughly five and a half hours on September 14, rewrote responses directly at the CDN's edge nodes.

The insidious part of the technique is that the substitution happened on the fly: Brevo's origin servers and files remained untouched, so standard integrity checks noticed nothing. At the same time, the worker stripped protective headers, including Content-Security-Policy. The affected pages included brevo.com, sendinblue.com, a number of subdomains, as well as the scripts for forms, the Conversations widget, and the SDK loader.

Brevo stresses that the app.brevo.com application, the API, the email delivery infrastructure, and customer account data were not affected. The key, by its estimate, may have been compromised as far back as late August, though no traces of earlier malicious activity were found.

What visitors saw

The firm Sansec was the first to report the problem, estimating the reach at potentially up to 100,000 sites using the affected Brevo components. Visitors were shown a fake Cloudflare verification page and then ClickFix instructions prompting them to run a command in Windows.

On WordPress-powered sites, the script behaved more cunningly: it checked whether the visitor was logged in as an administrator and attempted to install a malicious plugin disguised as “Web Media Optimizer.” In reality it is a backdoor that hides itself from the plugin list, copies itself into the must-use directory to persist, and periodically contacts a command-and-control server. The plugin downloads and injects malicious JavaScript to visitors, keeps a backup copy of the last working address in case the server is unavailable, and contains a hardcoded key that allows an administrator session to be created without a password.

The second incident in a week

This is not Brevo's only trouble: on September 10, the company disclosed a separate incident involving SSO — at the time, phishing emails were being sent through hijacked accounts. Among those affected was the crypto wallet maker Trezor: the phishing reached 347,000 addresses, and at least 2,500 users were compromised. Brevo did not comment on whether the two incidents are connected.

WordPress administrators who visited the affected sites on September 14 are advised to review recently installed or activated plugins, remove suspicious ones, and change their passwords.

Source: Bleeping Computer