Brevo supply chain attack exposes over 100,000 websites

Brevo, the French marketing and communications platform formerly known as Sendinblue, suffered a supply chain attack that may have affected more than 100,000 websites. On September 10, the attackers reportedly exploited a vulnerability in the SAML SSO system, gaining access to 138 accounts, exporting contacts from 43 of them, and using six for phishing campaigns. Four days later, they returned via a long-lived Cloudflare API key with full permissions that was stored in the application's source code. The key allowed them to create Workers, routes, and DNS records and to inject malicious code into Brevo websites and three JavaScript files embedded in customer websites. The incident shows how a single privileged credential belonging to a SaaS provider can turn an internal compromise into a large-scale attack against downstream organizations.

Source: Security Affairs