Supply‑Chain Attack on Brevo Compromises Cloudflare Integration, Infects Over 100,000 Customer Websites
What Happened — Attackers first exploited a vulnerability in Brevo’s SAML SSO to steal 138 accounts, then used a long‑lived Cloudflare API key to create a malicious Cloudflare Worker. The worker rewrote HTTP responses at the edge, stripping security headers and injecting malicious JavaScript into Brevo‑hosted assets, which were then served to visitors of more than 100 k websites that embed Brevo scripts.
Why It Matters for Trust & Control Assurance
- Demonstrates how a single third‑party credential can turn a trusted service into a malware distribution platform, a scenario continuous control‑assurance programs are built to detect and evidence.
- Highlights the need for ongoing vendor‑risk monitoring, immutable API‑key management, and real‑time alerting on privileged cloud‑service actions.
- Provides a concrete example of why organizations must maintain auditable evidence of third‑party security controls to satisfy multiple framework requirements (e.g., NIST CSF, ISO 27001).
Who Is Affected – SaaS marketing platforms, their downstream customers (e‑commerce, media, luxury brands), and any website that loads Brevo’s tracking or email‑widget scripts.
Recommended Actions
- Inventory all Cloudflare API keys and enforce short‑lived, scoped credentials; rotate any long‑lived keys immediately.
- Implement continuous monitoring of third‑party cloud configurations (Workers, DNS records, routes) and integrate alerts into your security operations center.
- Review and harden SAML SSO configurations; enforce MFA and anomaly detection on privileged account logins.
Technical Notes – The initial breach leveraged a SAML SSO vulnerability (details not disclosed). The subsequent supply‑chain stage used a compromised Cloudflare API token to create a Worker that stripped CSP headers and injected a malicious WordPress plugin and click‑jacking overlay. No public CVE was assigned at the time of reporting. Source: SecurityAffairs