{"slug": "brevo-supply-chain-attack-one-api-key-100000-sites", "title": "Brevo Supply Chain Attack: One API Key, 100,000 Sites", "summary": "Attackers used a single hardcoded Cloudflare API key to hijack Brevo's CDN edge for five and a half hours on September 14, serving fake Cloudflare verification pages and silently installing a backdoor WordPress plugin across roughly 100,000 websites, according to Sansec research. The malicious Worker rewrote three embedded Brevo JavaScript files — sdk-loader.js, brevo-conversations.js, and the Brevo forms script — and stripped Content-Security-Policy headers while Brevo's origin servers stayed untouched. The backdoor plugin, named \"Web Media Optimizer,\" hid from the WordPress plugin list, persisted in the must-use plugins directory, and could generate valid administrator sessions without a password, calling home to glegchner[.]com.", "body_md": "On September 14, a single hardcoded Cloudflare API key gave attackers CDN-edge control over Brevo’s infrastructure. For five and a half hours, every website embedding a Brevo widget served either a fake “Cloudflare verification” page — or, for logged-in WordPress admins, silently installed a backdoor plugin capable of generating admin sessions without a password. Around 100,000 websites were in the blast radius. [Brevo’s origin servers were never touched.](https://sansec.io/research/brevo-supply-chain-attack)\n\n## One Key, Full CDN Control\n\nThe root cause is as old as it is preventable. Attackers obtained a long-lived Cloudflare API key with full account permissions that had been hardcoded in Brevo’s application source code. All five Brevo apex domains — brevo.com, sibforms.com, sendinblue.com, sibautomation.com, and sendibt1.com — run through Cloudflare DNS. That one key let them create Workers, register subdomains, and route traffic. A malicious SSL certificate for `cdn.sendibt1.com` was registered on August 25, suggesting the attackers held the key for weeks before pulling the trigger.\n\nThe Worker they deployed rewrote CDN edge responses for three JavaScript files Brevo customers embed on their sites: `sdk-loader.js`, `brevo-conversations.js`, and the Brevo forms script. It also stripped Content-Security-Policy headers from responses, ensuring browsers couldn’t block the injected code. The origin servers looked clean the entire time.\n\n## Two Payloads, Two Targets\n\nThe injected script checked who was visiting and acted accordingly.\n\nRegular visitors got a ClickFix overlay: a fake Cloudflare human-verification page instructing them to copy a command and paste it into their terminal. [ClickFix is the fastest-growing initial access technique of 2026](https://www.helpnetsecurity.com/2026/07/15/clickfix-social-engineering-attacks-report/) precisely because it exploits developer conditioning — technically literate users are accustomed to running `curl` commands from installation guides. The malware turns that habit against them.\n\nWordPress admins got something worse. If the script detected a logged-in administrator, it silently downloaded and installed a plugin called “Web Media Optimizer” from an attacker-controlled domain. The plugin hid itself from the WordPress plugin list, copied itself into the must-use plugins directory for persistence, and contained a hardcoded authentication mechanism that could generate valid administrator sessions without knowing the real password. It called home to `glegchner[.]com`. If you ran a WordPress site with a Brevo widget on September 14, check now:\n\n```\ngrep -rlE \"Web Media Optimizer|glegchner\" wp-content/\nls -la wp-content/mu-plugins/ | grep \"2026-09-14\"\n```\n\n## The Anti-Detection Detail That Should Concern You\n\nThe malware explicitly skipped activation for crawlers, developers, and automated security scanners. It fingerprinted the environment using DOM selectors before deciding to execute. Developers who tested their sites during the attack window saw nothing wrong. Their end users got hit anyway.\n\nThis is the defining feature of CDN-layer supply chain attacks: the attack surface isn’t on your servers. You can have immaculate origin security and still distribute malware to hundreds of thousands of browsers because you embedded a third-party script.\n\n## 2026’s Supply Chain Problem\n\nThe Brevo attack is the most visible incident in a pattern that’s defined 2026 security. The keyv npm package was backdoored in August via a compromised maintainer account. The LiteLLM supply chain was poisoned through a compromised Trivy instance, affecting 434,000 CI/CD pipelines. npm, PyPI, and Docker Hub were hit in coordinated attacks targeting developer credentials in April. In every case, the attacker used a stolen or hardcoded legitimate credential to make calls indistinguishable from normal developer activity.\n\nBehavioral anomaly detection doesn’t catch a valid API key making valid API calls. The only defense is to limit what those keys can do and ensure they aren’t sitting in your codebase.\n\n## What Developers Should Change Today\n\nThe obvious fix is the one Brevo had to learn the hard way: don’t hardcode credentials. Use a secret manager — AWS Secrets Manager, HashiCorp Vault, 1Password Secrets Automation — and scope keys to the minimum permissions the service actually needs. A Cloudflare key that only manages DNS records for one zone cannot create Workers or redirect CDN traffic.\n\nThe less obvious fix is [Subresource Integrity (SRI)](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity). When you embed a third-party script, you’re trusting that CDN to never serve you something malicious. SRI lets you specify a cryptographic hash of the expected file content:\n\n```\n\n```\n\nIf the CDN serves a tampered file, the browser rejects it. The Brevo attack would have failed silently on every site using SRI on those script tags. It takes ten minutes to implement. Most production sites don’t do it.\n\n[Brevo moved fast once they identified the attack](https://www.bleepingcomputer.com/news/security/brevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites/) — revoked the key, removed the Worker, purged caches, published a post-mortem within three days. That’s a reasonable incident response. The problem is the credential shouldn’t have been there in the first place.", "url": "https://wpnews.pro/news/brevo-supply-chain-attack-one-api-key-100000-sites", "canonical_source": "https://byteiota.com/brevo-supply-chain-attack-api-key/", "published_at": "2026-09-20 18:09:38+00:00", "updated_at": "2026-09-20 18:25:16.620836+00:00", "lang": "en", "topics": ["ai-crawlers"], "entities": ["Brevo", "Cloudflare", "Sansec", "WordPress", "Web Media Optimizer", "glegchner.com", "LiteLLM", "keyv"], "alternates": {"html": "https://wpnews.pro/news/brevo-supply-chain-attack-one-api-key-100000-sites", "markdown": "https://wpnews.pro/news/brevo-supply-chain-attack-one-api-key-100000-sites.md", "text": "https://wpnews.pro/news/brevo-supply-chain-attack-one-api-key-100000-sites.txt", "jsonld": "https://wpnews.pro/news/brevo-supply-chain-attack-one-api-key-100000-sites.jsonld"}}