Back Cryptonews

Brevo login flaw enabled phishing email targeting 347K Trezor subscribers

Cryptonews • September 11, 2026

In a Thursday postmortem, Brevo said six accounts were used to send phishing emails, contacts were exported from 43 and 93 accounts showed no meaningful activity. The platform did not specify whether the categories overlapped.

The attacker created a Brevo account, enabled single sign-on and invited legitimate Brevo users into the configuration. Brevo said access should have been confined to that organization, but an authorization boundary failed and granted access to every organization the invited users could reach.

The disclosure expands on warnings issued by Trezor and BitBox on Wednesday, identifying their shared provider and explaining why the emails passed normal authentication checks and appeared genuine.

Cointelegraph reached out to Brevo for more information but did not receive a response before publication.

In a blog post, Trezor said the phishing message, titled “Critical Security Alert: STM32 Entropy Vulnerability,” contained a link to an app that requested users’ wallet backups. The company disabled the domain at the DNS level within 20 minutes, but 2,500 people accessed the link before the takedown.

A Trezor spokesperson told Cointelegraph that “the initial email was sent to 347,000 customers,” all of whom were subsequently contacted the risk. The company’s Brevo account stored only opt-in email addresses and no other customer data.

“Until we hear more from Brevo, we are treating all roughly 347,000 addresses as known to the attacker and possibly reusable for phishing,” the spokesperson said.

A BitBox spokesperson told Cointelegraph that its unauthorized email was sent through Brevo and appeared to have reached its full and tutorial list.

BitBox said Brevo held only email addresses and language preferences. It found no evidence of compromised company credentials, downloaded contacts, lost funds or disclosed recovery phrases, but is treating the list as potentially accessed while awaiting Brevo’s logs.

Meanwhile, CoinTracking said its Brevo account distributed an email titled “Data Breach Notice: Please refresh API Keys as soon as possible.” It warned recipients not to follow the email’s links.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Attack Targets 347K Trezor Users via Brevo Breach A security flaw in Brevo's login system allowed an attacker to access 138 customer accounts, including those of Trezor, BitBox, and CoinTracking. The attacker exploited a weakness in Brevo's single sign-on (SSO) system, leading to phishing emails sent to approximately 347,000 Trezor customers. Six accounts were used to distribute phishing emails, while contacts were exported from 43 accounts. The phishing emails, titled 'Critical Security Alert: STM32 Entropy Vulnerability,' contained links to malicious applications requesting wallet backups. Trezor took down the malicious domain within 20 minutes, but around 2,500 users clicked the link before it was disabled. Brevo has acknowledged the breach and is investigating the incident. Trezor is treating all email addresses in its Brevo account as potentially compromised. 15 sources 69

Extracted Entities

Brevo login flaw enabled phishing email targeting 347K Trezor subscribers

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Vulnerabilities (1)