Threat Intel
Brevo Email Platform Breach Sparks Targeted Phishing of Crypto Firms
A flaw in Brevo’s SAML SSO allowed attackers to access 138 customer accounts, some of which were used to send phishing emails to subscribers of major crypto companies. Trezor, CoinTracking, and BitBox confirmed attacks, and defenders must verify email authenticity, audit third‑party services, and monitor for abnormal activity.
What happened
An attacker exploited a flaw in Brevo’s SAML SSO handling to gain access to 138 customer accounts on September 10. Six of those accounts were used to send phishing emails, 43 exported contact lists, and the remaining 93 showed no meaningful activity.
Impact
- Crypto wallet maker Trezor, portfolio tracker CoinTracking, and hardware provider BitBox confirmed phishing campaigns sent to their newsletter subscribers.
- Phishing emails impersonated security alerts, included malicious links, and targeted wallet backups or API keys.
- Approximately 347,000 Trezor newsletter recipients were warned of a fabricated hardware vulnerability.
What defenders should do
- Verify the authenticity of any security‑related emails from Brevo‑connected vendors; check the sender domain and email headers.
- Instruct users to avoid clicking links or downloading attachments from unexpected alerts.
- Audit Brevo and other third‑party email services for SAML SSO misconfigurations and enforce MFA.
- Monitor account activity for unusual export or send actions and revoke compromised credentials.
- Apply the latest patches for any referenced vulnerabilities (e.g., STM32 entropy bug) and review device firmware logs.
Mitigation steps
Implement strict email authentication (SPF, DKIM, DMARC) and use dedicated phishing detection tools. Coordinate with Brevo to confirm the breach is fully remediated and that no residual access remains.
Related articles
Trezor Warns 347,000 Users After Brevo Email Breach Sparks Phishing Campaign
Trezor revealed that a breach of its email‑service partner Brevo exposed 347,000 opt‑in newsletter addresses, which were used in a phishing attack that lured 2,500 users into clicking a malicious link. The fake “critical security alert” email claimed a microcontroller flaw in Trezor wallets could expose seed phrases. Trezor shut down the phishing domain within 20 minutes and suspended the Brevo account, stating no other Trezor systems were compromised. The incident follows earlier breaches involving Trezor’s support portal and logistics provider ShipMonk.
Read briefing
Cobalt Gang 2019 Phishing Campaign Targeting Global Financial Institutions
In 2019, the Cobalt Gang executed a sophisticated phishing operation aimed at financial institutions worldwide. The campaign leveraged spear‑phishing emails with malicious attachments to gain initial access. Defenders should review email filtering rules, enforce MFA, and conduct targeted user training.
Read briefing
Fake Tax Authority Emails Deploy Crypto Drainers – How to Detect and Block
Scammers are sending emails that appear to come from European tax authorities, luring recipients into clicking malicious links that install crypto‑draining malware. The attacks target individuals and organizations across Europe, using spear‑phishing with legitimate‑looking URLs and attachments. Defenders should verify sender domains, enable email authentication, block known malicious URLs, and monitor for unauthorized wallet activity.
Read briefing
UK Law Firms Face Rising Phishing and Ransomware Threats – NCSC Guidance
The NCSC report shows UK legal practices of all sizes are increasingly targeted by phishing and ransomware attacks. Defenders should enforce MFA, secure email gateways, keep software patched, maintain regular backups, and run incident response drills.
Read briefing