Marketing platform Brevo suffered a supply-chain intrusion after threat actors leveraged an account-level Cloudflare API key exposed in application source code. Rather than altering origin infrastructure, the attackers provisioned an unauthorized Cloudflare Worker across brevo.com, sendinblue.com, and sibforms.com. Executing directly at the CDN edge between 16:07 and 20:30 UTC on September 14, the worker dynamically stripped Content-Security-Policy (CSP) response headers and injected malicious JavaScript into customer-facing forms, Conversations widgets, and client-side SDK loaders.

The injected scripts served “ClickFix” lures masquerading as human-verification prompts, coercing site visitors to execute PowerShell commands that staged Lumma Stealer. Because the modification occurred transiently in-flight at the edge, origin servers and static asset stores showed zero file tampering, evading traditional integrity monitoring across downstream customer sites. Brevo contained the campaign by terminating the rogue worker, revoking the compromised API token, purging edge caches, and purging the credential from source control.

Why it matters:

• Ephemeral edge manipulation blinds defense-in-depth: Deploying programmable workers at the CDN edge weaponizes legitimate distribution channels to rewrite traffic in-flight; stripping CSP enforcement and modifying untampered origin assets completely evades conventional repository scanning, CI/CD audits, and origin file-integrity monitors.
• Enforce scoped API tokens and client-side script governance: Organizations must enforce strict least-privilege token scoping for CDN administrative APIs, continuously audit source code for credential leakage, and implement strict subresource integrity (SRI) alongside iframe sandboxing to isolate third-party widget scripts from the parent DOM.