Phishing Attack Targets 347K Trezor Users via Brevo Breach

• •Brevo's login flaw allowed access to 138 accounts, impacting Trezor, BitBox, and CoinTracking.
• •Phishing emails targeted 347,000 Trezor users, with 2,500 clicks on malicious links before takedown.
• •Brevo's SSO system failure led to unauthorized access across multiple organizations.

A security flaw in Brevo's login system allowed an attacker to access 138 customer accounts, including those of Trezor, BitBox, and CoinTracking. The attacker exploited a weakness in Brevo's single sign-on (SSO) system, leading to phishing emails sent to approximately 347,000 Trezor customers. Six accounts were used to distribute phishing emails, while contacts were exported from 43 accounts. The phishing emails, titled 'Critical Security Alert: STM32 Entropy Vulnerability,' contained links to malicious applications requesting wallet backups. Trezor took down the malicious domain within 20 minutes, but around 2,500 users clicked the link before it was disabled. Brevo has acknowledged the breach and is investigating the incident. Trezor is treating all email addresses in its Brevo account as potentially compromised.