For several hours on Monday, scripts that a very large number of websites load from the marketing platform Brevo were rewritten to attack the people visiting those sites. Brevo confirmed on Thursday how it happened. A long lived API key for its Cloudflare account, with full permissions, had been left hardcoded in the source code of one of its applications, and somebody found it.
Brevo, formerly known as Sendinblue, provides email marketing, signup forms and chat widgets to businesses. Customers add its JavaScript to their own pages, and that is what made the incident a supply chain attack. Nothing on the customers' servers was touched. The malicious code arrived inside a file they already trusted.
Changed at the edge, invisible at the origin
According to Brevo's account, the attackers used the key to create a Cloudflare Worker, a small program that runs on Cloudflare's network between a website and its visitors. The Worker modified responses as they passed through. It added a script to pages on Brevo's own website and its hosted forms pages, and it appended a loader to three JavaScript files that customers embed: the forms script, the Conversations chat widget and the SDK loader. It also stripped out security headers that would have limited what the injected code could do.
Because the tampering happened on the way out, the files on Brevo's own servers never changed, and the company's integrity checks saw nothing wrong. The key also allowed the intruders to create routes and DNS records across Brevo's domains without setting off an alert.
Brevo puts the exposure window at 16:07 to 20:30 UTC on September 14. It says the key appears to have been misused first in late August, but that it has found no malicious content served to visitors before the 14th. The Dutch security firm Sansec, which spotted the attack and published the first analysis, estimates that more than 100,000 websites use the affected components.
Two payloads, depending on who was looking
The injected script behaved differently depending on the visitor. Most people were shown a fake Cloudflare page asking them to verify that they were human, followed by instructions to paste a command and run it on their Windows computer. This is the ClickFix trick, and running the command installs malware. Sansec says the same overlay appeared for people who clicked a link, such as an unsubscribe link, in a marketing email sent through Brevo.
On WordPress sites that embed a Brevo widget, the script first looked for signs that the person viewing the page held an administrator session on that site. If so, it tried to use that session to install and activate a plugin, which Sansec believes to be a backdoor. An administrator simply looking at their own homepage that afternoon could have handed over the site.
The script stayed quiet when it detected crawlers, developer tools or automated scanners, which made the tampering harder to notice.
What Brevo did, and what site owners should check
Brevo says it removed the Worker and its routes, revoked the key and every credential created with it, took the hardcoded credential out of its code, deleted the hostnames the attackers had set up and purged its caches. It says its application, its API, its email delivery systems and customer account data were not affected.
For businesses that use Brevo's scripts, the cleanup depends on what kind of site they run:
- WordPress administrators who were logged in and browsing their site on September 14 should look for plugins installed or activated that day, remove anything they do not recognize and change administrator passwords.
- Anyone who followed the instructions on a verification page that afternoon should treat that computer as infected.
- Site owners who load scripts from any outside provider should consider whether a content security policy with reporting would have told them something was wrong. Sansec's own monitoring caught the attack through exactly such reports.
This was not Brevo's only recent trouble. On September 10 it had disclosed a separate incident in which a flaw in its single sign on handling let attackers into customer accounts, some of which were then used to send phishing emails. Brevo has not said whether the two are connected.
