Brevo Supply-Chain Attack: 100,000+ Websites Injected with Malicious Code — Detection and Remediation Guide

A supply-chain compromise at Brevo — the French marketing and customer communication platform formerly known as Sendinblue, whose client roster includes eBay, Louis Vuitton, and Michelin — has resulted in malicious code being injected into potentially more than 100,000 websites. According to reporting on the incident, attackers first breached Brevo on September 10 by exploiting a vulnerability, then leveraged compromised Cloudflare access to push malicious software downstream into customer web properties that integrate Brevo's services.

This is the classic third-party script supply-chain pattern we've seen with Magecart-style campaigns and CDN compromises: organizations that never wrote a line of vulnerable code are breached because a trusted vendor's JavaScript, tag, or CDN asset was weaponized upstream. If your marketing, e-commerce, or communications stack embeds Brevo (Sendinblue) assets — tracking scripts, form handlers, chat widgets, transactional email click trackers — your site may have served attacker-controlled content to your visitors without any change on your own infrastructure.

Defenders need to act on three fronts immediately: (1) determine whether your web properties load Brevo/Sendinblue assets, (2) hunt for unauthorized modifications and anomalous external script loads, and (3) harden your client-side supply chain so a single vendor compromise can't execute arbitrary code in your customers' browsers again.

Technical Analysis

Affected Products and Platforms

• Brevo (formerly Sendinblue) cloud marketing/communication platform and any customer website embedding its JavaScript snippets, forms, trackers, or widgets
• Cloudflare infrastructure tied to Brevo's account — the attackers abused compromised Cloudflare access as the distribution mechanism, meaning the delivery vector operated at the CDN/edge layer, not on customer origin servers
• Downstream impact: 100,000+ websites across Brevo's customer base, with enterprise brands including eBay, Louis Vuitton, and Michelin named as Brevo clients

No CVE identifier has been published in the available reporting for the initial Brevo vulnerability exploited on September 10. Treat the initial access vector as an unpatched/undisclosed vulnerability in Brevo's environment and focus defensive effort on the delivery mechanism — injected third-party script content — which is observable in your own telemetry regardless of the upstream root cause.

How the Attack Works (Defender's Perspective)

The attack chain follows the well-documented third-party script compromise model:

1. Initial compromise (Sept 10): Attackers exploit a vulnerability in Brevo's environment.
2. CDN access abuse: The attackers obtain or abuse access to Brevo's Cloudflare configuration, allowing them to modify content served at the edge — injected scripts, modified responses, or redirected asset loads — without touching customer origin servers.
3. Downstream injection: Because customer websites trust and load Brevo-hosted assets (or route through shared CDN infrastructure), the malicious code executes in the browsers of site visitors across the customer base.
4. Payload execution: Injected scripts in this class of campaign typically perform credential/session theft, form-field skimming (payment data on e-commerce pages), redirect chains to phishing or malware delivery, or secondary payload staging.

Key defensive implication: your origin server logs and file integrity monitoring may show nothing. The malicious content is served from the vendor's edge, so detection must focus on client-side behavior, outbound network connections from visitor sessions, CSP telemetry, and changes to third-party script content (hash drift).

Exploitation Status

• Confirmed active exploitation: Yes — this is a real-world compromise with malicious code reportedly served to over 100,000 websites.
• CISA KEV: No CVE has been published in the reporting, so no KEV entry applies at time of writing.
• Scope: Potentially any organization embedding Brevo/Sendinblue assets. The full payload scope (skimming vs. redirect vs. staging) should be validated against vendor disclosures as they emerge.

Detection & Response

Because the injection happens at the vendor's edge, the highest-fidelity detections are: (1) new or unexpected external domains loading scripts/exfil endpoints from your pages, (2) unexpected modifications to web assets or tag manager configurations, and (3) CSP violation telemetry. Tune the domain indicators below against Brevo's official IoC disclosure as it is published.

---
title: Third-Party Script Loading from Newly Observed External Domain
title_note: Supply-chain injection detection - web proxy telemetry
id: 4b7c2e91-8f3a-4d5b-9c6e-2a1f0d8b7e4c
status: experimental
description: Detects web sessions loading JavaScript from external domains that are not on the approved third-party script allowlist, consistent with supply-chain injected payloads (e.g., the Brevo/Sendinblue CDN compromise pushing attacker-hosted scripts to downstream sites).
references:
  - https://securityaffairs.com/199355/hacking/brevo-supply-chain-attack-infected-over-100000-websites.html
  - https://attack.mitre.org/techniques/T1189/
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1189
  - attack.t1195.002
logsource:
  category: proxy
detection:
  selection_uri:
    c-uri-extension: 'js'
  selection_exfil:
    cs-method:
      - 'POST'
      - 'PUT'
  filter_approved_cdn:
    c-dns|contains:
      - 'brevo.com'
      - 'sendinblue.com'
      - 'cloudflare.com'
      - 'cloudflareinsights.com'
      - 'googletagmanager.com'
      - 'google-analytics.com'
      - 'your-company-domain.com'
  condition: (selection_uri or selection_exfil) and not filter_approved_cdn
falsepositives:
  - New marketing/analytics tags deployed without change control - investigate against tag manager audit logs
  - A/B testing platforms and consent management tools
level: high
---
title: Web Content or JavaScript Asset Modified Outside Deployment Window
id: 9d3e5f21-6c8b-4a2d-b1e7-5f9a3c7d2e8b
status: experimental
description: Detects modification of JavaScript, HTML, or tag configuration files on web servers outside of approved CI/CD deployment activity. Catches origin-side tampering and helps validate whether injected content also touched locally hosted assets during a supply-chain event.
references:
  - https://securityaffairs.com/199355/hacking/brevo-supply-chain-attack-infected-over-100000-websites.html
  - https://attack.mitre.org/techniques/T1505/003/
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.defense_evasion
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|endswith:
      - '.js'
      - '.html'
      - '.php'
  selection_paths:
    TargetFilename|contains:
      - '/var/www/'
      - '/srv/www/'
      - '/usr/share/nginx/'
      - '/home/*/public_html/'
  filter_deploy_users:
    User|contains:
      - 'deploy'
      - 'jenkins'
      - 'github-actions'
      - 'ci-runner'
  condition: selection and selection_paths and not filter_deploy_users
falsepositives:
  - CMS admin panels performing legitimate in-place edits (WordPress, Drupal) - scope to non-CMS paths or correlate with CMS audit logs
level: high

// Hunt: outbound connections from endpoints to rare script/CDN domains
// Ingest web proxy logs as CommonSecurityLog (CEF) or use DnsEvents from Defender
// Purpose: surface newly-seen domains serving .js or receiving POSTs from user sessions
// since the Brevo compromise window (Sept 10). Tune $ApprovedDomains to your environment.
let ApprovedDomains = dynamic([
    "brevo.com", "sendinblue.com", "cloudflare.com", "cloudflareinsights.com",
    "googletagmanager.com", "google-analytics.com", "doubleclick.net",
    "your-company-domain.com"
]);
let LookbackStart = datetime(2025-09-10);
CommonSecurityLog
| where TimeGenerated >= LookbackStart
| where isnotempty(DestinationHostName)
| where RequestURL has ".js" or RequestMethod in ("POST", "PUT")
| extend Domain = tolower(DestinationHostName)
| where not(Domain has_any (ApprovedDomains))
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            HitCount = count(), DistinctSources = dcount(SourceIP),
            SampleURLs = make_set(RequestURL, 10)
    by Domain, DeviceVendor
| where FirstSeen >= LookbackStart  // domain first observed after compromise window
| sort by HitCount desc

-- Hunt: recently modified script/content files in web roots (origin-side tampering check)
-- Deploy as a Velociraptor hunt across Linux web servers.
-- Flags web content modified after the Brevo compromise window (2025-09-10).
SELECT FullPath, Size, Mtime, Atime,
       hash(path=FullPath).SHA256 AS SHA256
FROM glob(globs=[
    '/var/www/**/*.js',
    '/var/www/**/*.html',
    '/srv/www/**/*.js',
    '/usr/share/nginx/**/*.js',
    '/home/*/public_html/**/*.js'
])
WHERE Mtime > '2025-09-10'
ORDER BY Mtime DESC

The following Bash script audits a web server for recently modified script assets and inventories all external third-party script references currently served in your pages — the two fastest ways to establish whether you were in the blast radius.

#!/bin/bash
# brevo-supply-chain-audit.sh — audit web roots for tampering and third-party script exposure
# Run on origin web servers and against deployed static asset bundles.

WEBROOTS=("/var/www" "/srv/www" "/usr/share/nginx/html")
SINCE_DATE="2025-09-10"   # Brevo compromise window start
REPORT="/tmp/brevo_supply_chain_audit_$(date +%Y%m%d_%H%M%S).txt"

echo "=== Brevo Supply-Chain Exposure Audit ===" | tee "$REPORT"

echo -e "\n[1] Web content modified since $SINCE_DATE:" | tee -a "$REPORT"
for root in "${WEBROOTS[@]}"; do
  [ -d "$root" ] && find "$root" -type f \( -name '*.js' -o -name '*.html' -o -name '*.php' \) \
    -newermt "$SINCE_DATE" -printf '%TY-%Tm-%Td %TH:%TM  %u  %p\n' 2>/dev/null | tee -a "$REPORT"
done

echo -e "\n[2] External third-party script sources currently referenced:" | tee -a "$REPORT"
for root in "${WEBROOTS[@]}"; do
  [ -d "$root" ] && grep -rhoE '<script[^>]+src=["'"'"']https?://[^"'"'"']+' "$root" 2>/dev/null \
    | grep -oE 'https?://[^"'"'"']+' | sort -u | tee -a "$REPORT"
done

echo -e "\n[3] Brevo/Sendinblue asset references (confirm these are expected):" | tee -a "$REPORT"
grep -rhoE 'https?://[^"'"'"' ]*(brevo|sendinblue|sibautomation)[^"'"'"' ]*' "${WEBROOTS[@]}" 2>/dev/null \
  | sort -u | tee -a "$REPORT"

echo -e "\n[4] Inline script blocks containing suspicious exfil patterns (fetch/beacon/XHR to externals):" | tee -a "$REPORT"
for root in "${WEBROOTS[@]}"; do
  [ -d "$root" ] && grep -rlnE '(navigator\.sendBeacon|fetch\(|XMLHttpRequest)' "$root" \
    --include='*.js' --include='*.html' 2>/dev/null | tee -a "$REPORT"
done

echo -e "\nAudit complete. Review external domains in section [2] against your approved third-party list."
echo "Any domain you cannot attribute to a known vendor tag = investigate as potentially injected."

Remediation

Immediate actions (today):

1. Inventory your exposure. Identify every web property, landing page, and microsite embedding Brevo/Sendinblue scripts, forms, or trackers — including assets deployed via tag managers (GTM, Tealium), which are commonly forgotten. The audit script above plus your tag manager's container export will build this list quickly.
2. Pull or pin the vendor assets. Until Brevo confirms full remediation and publishes post-compromise asset integrity data, remove Brevo-hosted script references from payment flows, login pages, and account-management surfaces at minimum. Where functionality is business-critical, temporarily self-host a known-good, hash-verified copy of the script rather than loading it live from the vendor CDN.
3. Hunt retroactively to September 10. Run the KQL query above against proxy/DNS telemetry back to the compromise date. Any newly-observed domain serving JS or receiving POSTs from user sessions is a lead. Check for anomalous session token use, credential resets, and fraudulent transactions in affected session windows.
4. Rotate exposed secrets. If injected scripts executed on pages handling credentials, session cookies, or payment data, force password resets and invalidate sessions for affected user populations. Rotate API keys embedded in page-level integrations.
5. Monitor official disclosures. Track Brevo's trust/status communications and the original reporting at SecurityAffairs for published IoCs, affected-version details, and the vendor's remediation timeline. Incorporate vendor IoCs into proxy and DNS blocklists as released.

Structural hardening (this quarter):

6. Deploy Subresource Integrity (SRI) on every third-party script where the vendor serves stable-versioned assets. SRI would have turned this campaign into a broken-script error instead of code execution. For vendors that serve mutable content (which breaks SRI), that fact alone is a risk-acceptance conversation to have with procurement.
7. Implement a restrictive Content Security Policy with an explicit script-src allowlist and a report-uri/report-to directive feeding CSP violation reports into your SIEM. CSP telemetry is your best early-warning sensor for injected script origins.
8. Adopt client-side script monitoring (e.g., a web application and API protection platform with client-side supply-chain visibility, or commercial tools purpose-built for Magecart detection) that alerts on script content/hash drift and new DOM-injected origins.
9. Enforce change control on tag managers. Require approval workflows and audit logging for any new tag or script container change — marketing teams deploying unvetted tags are functionally equivalent to the vendor compromise you just survived.
10. Update third-party risk assessments. Add Brevo-class scenarios (vendor CDN compromise → edge-level content injection) to your vendor security questionnaires and require disclosure SLAs, asset integrity guarantees, and CDN access controls (MFA, scoped API tokens) from marketing/communication platform vendors.

The bottom line: your perimeter did not fail here — your trust model did. Every externally hosted script is remote code execution you pre-authorized. Treat third-party JavaScript with the same scrutiny you apply to third-party software: inventory it, pin it, monitor it, and be able to kill it in minutes.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub