Stolen Cloudflare API Key Enables Supply-Chain Attack via CDN Edge Manipulation
Attackers compromised Brevo's infrastructure by stealing a Cloudflare API key, which granted them the ability to deploy a malicious Worker that silently modified JavaScript delivered to customer websites at the CDN edge — without touching Brevo's origin servers directly. This attack vector is particularly dangerous because CDN-level tampering can affect thousands of downstream customers simultaneously, and the modifications are often invisible to traditional endpoint or server-side monitoring. The five-and-a-half-hour window of exposure highlights how quickly a single compromised credential can cascade into a widespread supply-chain event. This matters because customers implicitly trust scripts served from vendors they embed on their sites, making CDN-injected malware extremely effective at bypassing end-user defenses.
Tactical Insight
Immediate actions
- Rotate and audit all CDN and third-party API keys immediately, applying the principle of least privilege to each credential.
- Remove or disable any unauthorized Cloudflare Workers, Page Rules, or edge functions and verify CDN configuration integrity against a known-good baseline.
- Notify affected customers with clear indicators of compromise (IOCs) and recommended remediation steps.
Long-term improvements
- Implement Subresource Integrity (SRI) hashes for all externally served JavaScript files so browsers can detect unauthorized modifications.
- Store API keys and secrets in a dedicated secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager) with automatic rotation policies and strict access controls.
- Enforce multi-factor authentication (MFA) and IP allowlisting on all CDN and cloud provider administrative accounts.
Detection measures
- Deploy real-time alerting on CDN configuration changes, including creation or modification of Workers, routes, and DNS records.
- Continuously monitor externally served JavaScript assets for unexpected content changes using integrity-checking tools or a third-party script monitoring service.
- Establish baseline behavioral analytics for API key usage to detect anomalous access patterns such as unusual geolocations or off-hours activity.