Summary
- Attackers obtained a long-lived Cloudflare API key with broad permissions and created a malicious Worker.
- Brevo-hosted pages and three JavaScript components embedded on customer sites were altered during the incident.
- Brevo says its main application, API, email infrastructure, and customer-account data were not compromised.
A stolen infrastructure credential at Brevo allowed attackers to alter content at the CDN edge and push malicious code through JavaScript components embedded on customer websites, extending an internal credential failure into a downstream supply chain incident.
Brevo said attackers obtained a long-lived Cloudflare API key with extensive account permissions and used it to create a malicious Cloudflare Worker. Rather than altering files on Brevo’s origin servers, the Worker rewrote web responses as they passed through Cloudflare’s edge infrastructure.
The attack affected Brevo-controlled pages and three JavaScript components used by customers: its forms script, Conversations widget, and SDK loader. Brevo places the malicious activity on 14 September, with the affected period lasting roughly five and a half hours.
The distinction between edge and origin compromise complicated detection. Brevo said its underlying files remained unchanged while the Worker modified delivered content and removed security headers including Content-Security-Policy. Conventional integrity checks against the origin therefore did not identify the manipulation.
Visitors to affected pages could be shown ClickFix social-engineering content designed to persuade Windows users to execute commands. Separate analysis of the malicious scripts found additional targeting of WordPress administrators visiting affected sites while logged in, including attempts to install a malicious plugin.
Brevo removed the Worker and associated routes after detecting the compromise, revoked the exposed API key and credentials created with it, deleted attacker-controlled hostnames, purged edge caches, and removed the hardcoded credential from application source code.
The company said app.brevo.com, its API, email delivery infrastructure, and customer-account data were not affected by this incident.
The compromise demonstrates how much authority can accumulate in credentials used to manage content-delivery infrastructure. An API key capable of creating Workers, changing routes, or modifying DNS configuration may sit outside the core business application while still controlling the code that ultimately reaches users.
That creates a different form of supply chain exposure from a compromised software package. Customers can maintain the integrity of their own servers and code while continuing to load a trusted third-party JavaScript component whose behaviour changes upstream without any deployment action on their side.
Externally hosted scripts are widely used for forms, analytics, communications tools, payment functions, and customer-support components. Their convenience also creates an inherited trust path: code executes inside the customer’s site while its delivery and update process remains under another company’s control.
The incident follows a separate Brevo SAML incident earlier in September, in which attackers crossed customer-account boundaries and subsequently abused compromised accounts for phishing. Brevo has not established that the two events were connected, and their technical mechanisms were different.
Taken together, the incidents expose two distinct concentration points inside a communications provider: federated identity capable of affecting customer accounts, and infrastructure credentials capable of altering content delivered downstream.
The immediate Cloudflare incident has been contained. The more durable control questions concern the lifetime and scope of provider infrastructure credentials, the storage of secrets in source code, monitoring of CDN control-plane changes, and whether customers can detect when trusted externally loaded code changes unexpectedly.
