Attackers rewrote Brevo's embedded scripts at Cloudflare's edge with a hardcoded full-permission key

A Cloudflare API key with full account permissions can create Workers, routes and DNS records across every zone on the account. Brevo says the key in its application source code was long-lived and did all three for the attackers without triggering an alert ^[2]. The Worker they built sat in front of the origin and edited what came out of it. "Because the Worker rewrote responses at the edge and removed security headers such as Content-Security-Policy, our origin servers and files remained unmodified and standard integrity checks did not detect the change," Brevo said in its post-mortem ^[6]. Anyone hashing files on Brevo's servers that afternoon would have found them correct.

The duration is unsettled. Brevo calls it approximately five and a half hours of edge modification ^[1] and elsewhere defines the exposure window as 16:07 to 20:30 UTC, a span of 4 hours 23 minutes ^[5][1]. Sansec dates the activity from 16:05 to 20:13 UTC, 4 hours 8 minutes ^[11][2]. Both observed windows run about an hour shorter than the figure in Brevo's own summary ^[3]. Brevo also says the key may have been exposed as early as late August, with no evidence of malicious use before September 14 ^[7].

On WordPress sites embedding an affected widget, the injected script checked whether the visitor was logged in as an administrator, then tried to upload wm.zip from cdn10.sendibt1[.]com ^[13]. BleepingComputer pulled a copy from VirusTotal and describes a plugin named "Web Media Optimizer" that works as a persistent backdoor and JavaScript loader ^[14]. It hides itself from the plugin list, copies itself into the must-use plugins directory, and polls glegchner.com/ads.php ^[15]. That server returns a Base64 string, currently decoding to corralos[.]beer/a412dkoq.js ^[16], and the plugin caches the last working URL so it keeps loading code if the server stops answering ^[17]. A hardcoded authentication key inside it generates a valid administrator session without the password ^[18]. BleepingComputer also saw the plugin and scripts served from yelahaye[.]surf and boiseno[.]club ^[19].

Brevo revoked the key, removed the credential from source, deleted attacker hostnames and purged its edge caches ^[8]. None of that touches an installed copy of the plugin, which persists locally and calls its own server ^[5].

Brevo says app.brevo.com, its API, email delivery infrastructure and customer account data were not affected ^[9]. If you do not embed the forms script, the Conversations widget or the SDK loader, and no administrator browsed an affected site on September 14, this one is closed for you ^[3][4][23].

This is Brevo's second disclosure in five days. On September 10 the company reported an SSO-related incident in which attackers hijacked customer accounts and ran phishing against those customers' users ^[20]. Trezor said on September 11 that the phishing reached 347,000 email addresses and compromised at least 2,500, about 0.7% ^[21][4]. Brevo did not answer BleepingComputer's questions about whether the two incidents are connected ^[22].