Brevo breach exposed Cloudflare API key, spread malware via JS

Brevo, a Paris-based email delivery and marketing platform, confirmed a security breach involving the theft of a Cloudflare API key. Attackers used the compromised key to inject malicious JavaScript scripts, identified as ClickFix, into Brevo’s own websites and files embedded on customer sites. The scripts were designed to distribute malware to end users visiting affected pages, though the full scope of impacted customers remains unclear.

What happened

The breach was detected after customers reported unusual behavior on sites using Brevo’s embedded JavaScript files. Investigations revealed that attackers had obtained a Cloudflare API key, which allowed them to modify Brevo’s hosted assets. The injected ClickFix scripts were then served to visitors, potentially exposing them to malware downloads. Brevo has not disclosed how the API key was initially compromised or whether additional credentials were accessed during the incident.

Brevo’s response included revoking the stolen API key and conducting a forensic review of affected systems. The company stated that it has implemented additional safeguards to prevent similar incidents, though specific measures were not detailed. No timeline for the attack’s duration or the number of affected customers has been provided.

What we don’t know yet

Sources do not clarify whether the attack was opportunistic or targeted, nor do they specify the method used to exfiltrate the Cloudflare API key. The total number of impacted customers and the geographic distribution of affected sites remain undisclosed. Brevo has not indicated whether regulatory notifications have been filed or if law enforcement is involved.