Brevo Suffers Major Security Breach: Cloudflare API Key Compromised, Leading to Widespread Malware Distribution

Brevo, a prominent customer relationship management and digital marketing company, has confirmed a significant security incident involving the compromise of a Cloudflare API key, which attackers exploited to inject malicious ClickFix scripts across its websites and JavaScript files embedded on customer sites. This breach, which occurred on September 14, 2024, allowed threat actors to distribute malware to potentially thousands of websites that rely on Brevo’s services for their online operations. The incident highlights critical vulnerabilities in API key management and the far-reaching consequences of supply chain attacks within the digital ecosystem.

The attackers gained unauthorized access to a long-lived Cloudflare API key that possessed full account permissions. Alarmingly, this key had been hardcoded directly into Brevo’s application source code, a practice that cybersecurity experts consistently warn against due to its inherent risks. This ill-advised security posture enabled the attackers to operate with significant latitude, creating malicious Cloudflare Workers, modifying routes, and even altering DNS records across Brevo’s domains without immediately triggering any security alerts. The compromised API key’s extensive privileges allowed the attackers to effectively operate as legitimate administrators within Brevo’s Cloudflare infrastructure for a period of approximately five and a half hours.

The compromised Cloudflare Worker was designed to intercept and modify web traffic at the Content Delivery Network (CDN) edge. This meant that the malicious scripts were injected into the content delivered to end-users before it reached Brevo’s origin servers. Crucially, this technique allowed the attackers to bypass standard security checks and integrity monitoring systems, as Brevo’s own servers and files remained untouched. The attackers also deliberately removed security headers, such as Content-Security-Policy, from the responses, further weakening the security posture of the affected websites and making it harder for browsers to detect the malicious activity.

The incident began on September 14, 2024, with the exposure window identified between 16:07 and 20:30 UTC. During this critical period, visitors to several Brevo-affiliated websites, including brevo.com, sendinblue.com, login/account/my/onboarding.brevo.com, and sibforms.com, were potentially exposed. Beyond the core Brevo domains, the attack also compromised essential components used by Brevo’s customers. This included the Brevo forms script, the Brevo Conversations widget, and the Brevo SDK loader scripts, all of which are frequently embedded on third-party websites to enhance their functionality and customer engagement. The potential impact on these customer websites is substantial, as it represents a direct supply chain compromise where a trusted service provider’s infrastructure is leveraged to attack its users.

Timeline of the Attack and Remediation Efforts

The full extent of the attack and Brevo’s response can be pieced together through their post-mortem analysis and independent investigations.

• Late August 2024: The compromised Cloudflare API key may have been exposed as early as this period. However, Brevo has stated that there is no evidence of malicious activity occurring prior to the confirmed exploitation window. This suggests a period of dormancy or reconnaissance by the attackers before initiating their offensive actions.
• September 14, 2024 (16:07 UTC): The confirmed malicious activity begins. Attackers leverage the compromised Cloudflare API key to deploy a malicious Cloudflare Worker.
• September 14, 2024 (16:07 – 20:30 UTC): The exposure window during which malicious scripts are injected into website content at the CDN edge. This period lasted approximately five and a half hours.
• September 14, 2024 (20:30 UTC onwards): Brevo detects the compromise and initiates remediation. The malicious Worker and its associated routes are removed.
• Post-detection: Brevo takes several critical steps to secure its infrastructure. This includes revoking the compromised API key and all credentials generated with it, removing the hardcoded API key from its source code repositories, deleting any attacker-controlled hostnames, and purging its edge caches to ensure that no cached malicious content remains accessible.
• September 15, 2024: Security firm Sansec confirms that all malicious subdomains used in the attack have stopped resolving, and Brevo’s files are reported as clean.

The swift response by Brevo, while commendable in its execution of remediation steps, underscores the critical importance of proactive security measures, particularly concerning API key management. The fact that a long-lived key with full permissions was hardcoded in source code points to a significant lapse in secure development practices.

The Mechanics of the ClickFix Attack

The malicious scripts injected by the attackers were part of a campaign known as "ClickFix." Security researchers at Sansec were the first to publicly detail the incident, estimating that up to 100,000 websites utilizing affected Brevo components could have been impacted.

Visitors to compromised websites were initially presented with a seemingly legitimate Cloudflare verification page. This page was designed to trick users into believing there was a security issue with their connection or the website itself. Following this fake verification, users were presented with "ClickFix" instructions, often prompting them to execute a command on their Windows operating system. This is a common tactic used to download and install further malicious payloads.

For WordPress websites that embedded an affected Brevo widget, the attack took a more targeted approach. The script would first check if the visitor was logged into the WordPress dashboard as an administrator. If administrator privileges were detected, the attackers attempted to upload a malicious plugin. This plugin was distributed from domains such as cdn10.sendibt1[.]com.

BleepingComputer’s analysis of a sample of this malicious plugin, uploaded to VirusTotal under the hash f359ab0d2f732b54dd3300065f4d6553f4df1b67454b71fd81197e26f02af4a8, revealed its true nature. Despite masquerading as a legitimate WordPress plugin named "Web Media Optimizer," it functions as a persistent backdoor and a JavaScript loader. The plugin employs sophisticated evasion techniques:

• Self-Concealment: It hides itself from the standard WordPress plugin list, making it difficult for administrators to detect its presence through the usual interface.
• Persistence: To ensure it remains active even after server reboots or plugin updates, it copies itself into the WordPress must-use plugins directory. Must-use plugins are automatically activated and cannot be deactivated through the dashboard, providing a strong layer of persistence for the malware.
• Command and Control (C2) Communication: The plugin periodically contacts a remote server controlled by the attackers, specifically https://glegchner.com/ads.php. This server provides instructions and further malicious code.
• Dynamic Payload Delivery: The ads.php server currently returns a Base64-encoded URL, which decodes to https://corralos[.]beer/a412dkoq.js. The plugin then fetches and injects this JavaScript into visitor pages, which in turn displays the ClickFix lure.
• Redundancy: To maintain functionality even if the primary C2 server is down, the plugin stores a backup of the last known valid JavaScript URL. This ensures that malicious code can continue to be loaded, providing a degree of resilience for the attackers.
• Authentication Bypass: A critical feature of the plugin is a hardcoded authentication key. This key allows attackers to forge a valid administrator login session for a WordPress website without needing to know the actual administrator’s password. This grants them unfettered access to the website’s backend, enabling further malicious activities, such as defacement, data theft, or redirecting traffic.

Other domains identified by BleepingComputer as distributing the malicious WordPress plugin and scripts include https://yelahaye[.]surf and https://boiseno[.]club, indicating a distributed infrastructure for their operations.

Broader Implications and Previous Incidents

This latest incident raises serious concerns about the security posture of companies relying on third-party services for critical infrastructure and functionality. The compromise of Brevo’s Cloudflare account is a stark reminder of the interconnectedness of the digital supply chain. A vulnerability in one service can have cascading effects across numerous others.

The estimated reach of up to 100,000 affected websites underscores the scale of the potential damage. For businesses, this could translate to significant reputational damage, loss of customer trust, financial losses due to downtime or data breaches, and the costs associated with incident response and remediation.

It is also important to note that this is not the first significant security incident to affect Brevo in recent times. On September 10, 2024, Brevo disclosed a separate incident related to Single Sign-On (SSO) vulnerabilities. In that breach, attackers hijacked customer accounts and launched sophisticated phishing campaigns targeting customers of companies that use Brevo’s services. A high-profile victim of this prior attack was Trezor, a cryptocurrency wallet vendor. Trezor reported that the phishing attacks reached 347,000 user email addresses, with at least 2,500 accounts being successfully compromised.

Brevo has not provided information on whether the SSO incident and the subsequent Cloudflare compromise are connected. However, the proximity of these two significant security events suggests a potential pattern of vulnerability or a sustained targeting of Brevo’s infrastructure by malicious actors. The fact that attackers could exploit a hardcoded API key with broad permissions after a previous account hijacking incident raises questions about the thoroughness of their security reviews and remediation efforts.

Recommendations for Administrators

For WordPress administrators, particularly those who may have visited an affected site while logged in on September 14, 2024, immediate action is recommended:

1. Audit Installed Plugins: Thoroughly review the list of installed and activated plugins in the WordPress dashboard. Look for any unusual or recently installed plugins that cannot be accounted for, especially those named "Web Media Optimizer" or similar.
2. Remove Suspicious Plugins: If any suspicious plugins are found, they should be immediately deactivated and deleted.
3. Rotate Administrator Passwords: As a precautionary measure, it is highly advisable to rotate all administrator passwords for the WordPress website. This is especially critical if the "Web Media Optimizer" plugin or any other suspicious activity was detected, as it could indicate an authentication bypass.
4. Review User Accounts: Examine all user accounts for any unauthorized additions or modifications.
5. Monitor Website Activity: Continuously monitor website logs and performance for any unusual behavior, such as unexpected traffic spikes, redirect issues, or the appearance of unfamiliar content.

The Brevo incident serves as a critical case study for organizations worldwide. It emphasizes the paramount importance of robust API key management, secure coding practices, regular security audits, and comprehensive incident response plans. The reliance on third-party services, while offering efficiency and specialized functionality, introduces inherent risks that must be meticulously managed to protect against sophisticated and evolving cyber threats. The implications of such breaches extend far beyond the immediate victim, impacting entire ecosystems of businesses and their customers.