[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1n-SyXbtKtlmmv625X6gQ7BVxh8BKQMDRSuR34867xY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":26,"created_at":27,"published_at":28,"article":29,"tags":33,"podcasts":52,"controls":59},"a8b1266f-6674-486d-bb92-de821c035525","brevo-supply-chain-attack-compromises-100000-sites-via-saml-flaw-and-stolen-api-key","7cf5c463-9629-40b3-8634-99685a08c13b","Brevo Supply Chain Attack Compromises 100,000 Sites via SAML Flaw and Stolen API Key","Attackers exploited a SAML SSO vulnerability to gain initial access to Brevo accounts, then pivoted by stealing a Cloudflare API key to deploy a malicious worker that poisoned JavaScript files served to over 100,000 downstream websites. This is a textbook supply chain attack: a single trusted platform became the delivery mechanism for malware affecting a massive number of end users who had no direct relationship with the compromised component. The use of a stolen API key highlights the danger of long-lived, overprivileged credentials with insufficient monitoring. The attack ultimately weaponized user trust — visitors were served fake Cloudflare verification pages designed to execute malicious commands, demonstrating how supply chain compromises amplify social engineering at scale.","**Immediate actions:**\n- Rotate and audit all third-party API keys and service credentials immediately following any suspected compromise.\n- Enforce MFA and strict session controls on all SSO\u002FSAML identity providers to limit the blast radius of credential theft.\n- Implement Subresource Integrity (SRI) hashes on all externally loaded JavaScript files to detect unauthorized script modifications.\n\n**Long-term improvements:**\n- Apply the principle of least privilege to all API keys and service accounts, scoping permissions to only what is strictly required.\n- Conduct regular third-party and supply chain risk assessments, including audits of all embedded scripts and CDN dependencies.\n- Establish a vendor security review process that includes mandatory disclosure of security incidents affecting shared infrastructure.\n\n**Detection measures:**\n- Deploy real-time monitoring and alerting on API key usage, flagging anomalous geographic locations, volume spikes, or new resource creation.\n- Implement Content Security Policy (CSP) headers across all web properties to restrict unauthorized script execution.\n- Monitor JavaScript file integrity continuously using automated tooling to detect unexpected changes to distributed scripts.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"CIS Control 3: Data Protection","CIS Control 5: Account Management","CIS Control 6: Access Control Management","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management","NIST AC-2: Account Management","NIST AC-6: Least Privilege","NIST SI-7: Software, Firmware, and Information Integrity","NIST SR-6: Supplier Assessments and Reviews","OWASP A06:2021 – Vulnerable and Outdated Components","GDPR Article 32: Security of Processing","GDPR Article 33: Notification of a Personal Data Breach","ITIL: Change and Release Management",{},"published","2026-09-18T10:20:23.051946+00:00","2026-09-18T10:20:22.721+00:00",{"id":7,"url":30,"slug":31,"title":32},"https:\u002F\u002Fwww.securityweek.com\u002Fbrevo-supply-chain-attack-injects-malware-into-100000-websites\u002F","brevo-supply-chain-attack-injects-malware-into-100-000-websites-110c0e","Brevo Supply Chain Attack Injects Malware Into 100,000 Websites",[34,40,46],{"id":35,"name":36,"slug":37,"description":38,"color":39},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":41,"name":42,"slug":43,"description":44,"color":45},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":47,"name":48,"slug":49,"description":50,"color":51},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[53],{"id":54,"date":55,"edition":56,"title":57,"audio_url":58},"af5388cc-d8d5-4255-b753-58776e161996","2026-09-18","afternoon","ThreatNoir Afternoon Brief — September 18","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-18\u002Fthreatnoir-afternoon-brief-2026-09-18.mp3",[60,64,68],{"slug":61,"name":62,"problem":63},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":65,"name":66,"problem":67},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",{"slug":69,"name":70,"problem":71},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]