The email marketing platform Brevo, formerly known as Sendinblue, had already drawn attention just days earlier over a security incident tied to phishing emails. Now a further incident has emerged: attackers slipped malicious code into Brevo customers' sites, tricking visitors into installing malware. According to security researchers at Sansec, more than 100,000 websites are affected.
Many companies use Brevo to run their email marketing campaigns, and the provider says it has more than 600,000 customers worldwide, including Ikea, Doctolib, Continental, Louis Vuitton, Nestle, Zeiss, VW, Bitbox, Trezor, and Cointracking. Some of Brevo's features rely on JavaScript files that customers embed on their own websites. Using a compromised Cloudflare API key, attackers injected malicious code exactly there on September 14, which was then served to website visitors for several hours.
A fake CAPTCHA smuggles a command through the clipboard
The affected websites were folded into what's known as a Clickfix campaign. Visitors were shown a fake CAPTCHA that, to supposedly solve it, asked them to press Win + R, then Ctrl + V, and confirm with Enter to run a command that had already been copied to their clipboard, which resulted in a malware download. The fraudulent CAPTCHAs also appeared at times when someone tried to unsubscribe from a newsletter sent through Brevo, though not to every visitor of the affected sites, the attackers' script apparently only showed it to select users. For logged-in WordPress admins, the attackers had an additional surprise: a suspicious plugin was automatically installed in the background, one Sansec couldn't analyze but suspects was meant to serve as a backdoor.
The API key had reportedly sat in source code since August
According to Brevo, the attack began around 16:23 German time on September 14, and by around 22:30 the company had revoked the compromised API key along with the credentials created with it, containing the attack. Brevo says it subsequently notified affected customers. Anyone who ran the fake CAPTCHA's command should consider their system compromised and check for possible malware infections. The stolen key had apparently been stored in an application's source code, where an attacker was able to grab it as early as August, according to Brevo. In response, the company has announced several measures to prevent similar attacks in the future, including managing API keys through Hashicorp Vault.