On September 14, 2024, attackers exploited a stolen Cloudflare API key to inject malicious scripts into up to 100,000 websites. The target was Brevo, a digital marketing and CRM platform whose tracking scripts run on customer sites.
The attackers used Brevo's compromised API credentials to create a Cloudflare Worker, modifying the company's CDN configuration to serve malicious JavaScript instead of legitimate tracking code. For four hours, every site using Brevo's components loaded scripts designed to steal credentials through fake browser update prompts.
Attack Timeline
16:07 UTC, Attackers deploy malicious Cloudflare Worker using stolen API key.
16:07-20:30 UTC, Modified CDN configuration serves malicious scripts to sites using Brevo components.
20:30 UTC, Brevo detects unauthorized changes and revokes the compromised API key.
Post-incident, Sansec reports that the attack also involved a fake Cloudflare verification page and a malicious WordPress plugin.
The four-hour window represents detection time, not exploitation time. The API key could have been stolen days or weeks earlier.
Control Failures
Secrets management: The Cloudflare API key was accessible to attackers. Whether it was hardcoded, stored in a shared wiki, or exfiltrated from a developer workstation, a credential with write access to production CDN configuration existed outside Brevo's control perimeter.
API key scoping: The compromised key had permissions to create Workers and modify CDN routing rules. A read-only key or a key scoped to specific zones couldn't have enabled this attack.
Change monitoring: Four hours passed between the unauthorized Worker deployment and detection. Brevo either wasn't monitoring their Cloudflare configuration for changes, or alerts weren't reaching anyone who could act.
Principle of least privilege: An API key that can create arbitrary Workers and reroute production traffic should require human approval or multi-party authorization. The attackers faced no additional gates after obtaining the credential.
Compliance Requirements
PCI DSS v4.0.1 Requirement 8.3.2 mandates that authentication credentials are protected during transmission and storage. For API keys, this means encryption at rest, using secrets management systems, and automatic rotation schedules.
Requirement 10.2.2 requires logging of all actions taken by privileged accounts. Your CDN provider's API calls count. If you can't produce logs showing who created that Worker at 16:07 UTC, you're not compliant.
ISO/IEC 27001:2022 Control 5.17 requires that allocation and management of secret authentication information is controlled through a formal process. This means documented procedures for key generation, rotation, scope limitation, and revocation.
NIST CSF v2.0 PR.AA-05 calls for identities and credentials to be issued, managed, verified, revoked, and audited. The "managed" component includes monitoring for unauthorized use. If your Cloudflare API key creates a Worker you didn't authorize, you should know within minutes, not hours.
Lessons for Your Team
Audit every API key you've issued. Start with your CDN provider, but don't stop there. Find keys for your payment gateway, email service, analytics platform, and CI/CD system. Document what each key can do and who's responsible for it. If you find keys scoped to "admin" or "full access," you've found your first remediation target.
Implement credential rotation. Cloudflare API keys can be rotated without downtime using their token rollover feature. Set a 90-day maximum lifetime. This creates work, but the alternative is waiting for someone to steal a three-year-old key from a contractor's laptop.
Monitor configuration changes in real-time. Your CDN provider offers webhooks or API endpoints that emit events when Workers are created, zones are modified, or routing rules change. Feed these into your SIEM or send them to a Slack channel someone actually reads. Configure alerts for any Worker creation or DNS modification outside your deployment windows.
Scope keys to specific resources. Cloudflare lets you create tokens limited to specific zones and operations. A key that can only read analytics data can't create Workers. A key scoped to your staging zone can't touch production. If your current keys have global permissions, you're one phishing email away from becoming a case study.
Require approval for privileged operations. Platforms like Terraform Cloud and GitHub Actions support approval workflows. Deploying a new Worker should require a pull request review and a manual approval step. This won't stop a stolen key from being used directly against the API, but it forces attackers to work outside your deployment pipeline where they're easier to spot.
Test your detection. Create a test Worker in your Cloudflare account right now. Did anyone on your team get an alert? If not, your monitoring isn't working. The attackers in this incident had four hours to operate. You need to know within four minutes.
The Brevo incident shows that supply-chain attacks don't require zero-day exploits or nation-state resources. They need one credential with too many permissions and an organization that isn't watching when that credential gets used. Your API keys are credentials. Treat them like passwords to your production environment, because that's exactly what they are.
