Brevo Supply Chain Attack Injects Malware Into Over 100,000 Websites

What happened in the Brevo supply chain attack

In early 2024 security researchers discovered that threat actors had gained access to a Brevo (formerly Sendinblue) API key. Using that credential they deployed a Cloudflare worker that silently altered the HTML of thousands of websites that relied on Brevo services. The altered pages delivered malicious JavaScript to visitors, allowing the attackers to harvest credentials, inject ransomware loaders, and redirect traffic to phishing sites.

How the compromised API key was used

Brevo provides email marketing and transactional email APIs that many content management systems integrate directly. The attackers stole an API key that granted them permission to create and modify Cloudflare workers associated with Brevo customers. A worker is a serverless script that runs at the edge of the network, capable of modifying responses before they reach a browser.

Step‑by‑step execution

Threat actors obtained a valid Brevo API key through credential stuffing and phishing.
Using the key they logged into the Brevo dashboard and linked a custom Cloudflare worker to the account.
The worker intercepted HTML responses from Brevo‑enabled sites and injected a malicious <script> tag.
The script loaded additional payloads from command‑and‑control servers, completing the infection chain.

The entire process required no changes to the victim sites themselves, making detection difficult for standard security scanners.

Impact on affected websites

Security analysts estimate that more than 100,000 domains were compromised. The malicious code varied by target but commonly performed the following actions:

Stealing session cookies and authentication tokens.
Redirecting users to fake login pages that harvested credentials.
Downloading ransomware binaries that encrypted local files.
Collecting browser fingerprint data for future targeted attacks.

Because the injection occurred at the edge, the malicious script appeared to originate from the legitimate domain, bypassing many content security policies.

Detection and mitigation steps

Organizations that rely on Brevo should take immediate action to verify the integrity of their integrations. Recommended steps include:

Revoke all existing API keys from the Brevo console and generate new ones.
Audit Cloudflare worker configurations for any unknown scripts.
Deploy a web‑application firewall rule that blocks unexpected <script> tags from untrusted sources.
Run a site‑wide scan for injected JavaScript using tools such as Snyk or OWASP scanners.
Monitor browser console logs for suspicious network requests.

Security researchers also recommend enabling subresource integrity checks for third‑party scripts, a practice that would have prevented the malicious payload from executing.

Industry response and lessons learned

Following public disclosure, Brevo issued an advisory and reset all API keys for affected customers. The company also updated its documentation to require multi‑factor authentication for API access. Cloudflare released a security bulletin urging users to review worker permissions and to adopt the principle of least privilege.

Government agencies such as CISA added the incident to its catalog of supply‑chain threats, highlighting the need for continuous monitoring of third‑party services. The NIST Cybersecurity Framework stresses the importance of identifying and protecting critical assets, a step that could have limited the attack surface in this case.

Overall, the Brevo incident underscores three core takeaways for security teams:

API credentials must be treated as highly sensitive assets and rotated regularly.
Serverless functions that sit at the network edge should be audited for unexpected behavior.
Supply‑chain risk assessments need to include not only software libraries but also cloud‑based services that modify traffic.

By adopting these practices, organizations can reduce the likelihood of a similar compromise affecting their online presence.