Brevo platform security breach and supply-chain attack

A security breach at the marketing platform Brevo evolved from a targeted phishing campaign into a widespread supply-chain attack.

Initially, attackers exploited a vulnerability in Brevo’s SAML single sign-on system to gain unauthorized access to approximately 138 customer accounts. This allowed them to export contact lists from 43 accounts, which were used to launch phishing attacks against cryptocurrency-related companies. For example, Trezor reported that attackers used Brevo’s legitimate infrastructure to send fraudulent emails regarding a supposed hardware vulnerability, affecting roughly 347,000 subscribers. Other firms, including Solana Mobile, BitBox, and CoinTracking, were also targeted.

In a subsequent phase, the attack expanded significantly. After the initial breach was blocked, attackers returned using a compromised, highly privileged Cloudflare API key. This allowed them to deploy a malicious Cloudflare Worker to inject code at the CDN edge, potentially affecting over 100,000 websites. This method enabled attackers to rewrite web responses and remove security headers without modifying Brevo’s origin servers. The attack attempted to distribute “ClickFix” scripts and install unauthorized plugins on WordPress sites.