Brevo vulnerability affects 138 customer accounts, 347,000 Trezor users receive phishing emails

BlockBeats news, September 11: Email marketing platform Brevo disclosed that attackers exploited an authorization boundary vulnerability in its login system to access 138 customer accounts. Among them, 6 accounts were used to send phishing emails, contact information from 43 accounts was exported, and 93 accounts showed no valid activity. Brevo did not specify whether there was overlap among these categories.

Affected customers include crypto hardware wallet manufacturers Trezor, BitBox, and crypto portfolio and tax reporting platform CoinTracking. Through Trezor's Brevo account, attackers sent phishing emails titled "Critical Security Alert: STM32 Entropy Vulnerability" to approximately 347,000 newsletter subscribers, luring users to enter an application and submit wallet backup information. Trezor blocked the relevant domain at the DNS level within 20 minutes, but about 2,500 people had already visited the link.

Trezor stated that its Brevo account only stored subscribers' email addresses and did not contain other customer data, but at this stage it is treating all approximately 347,000 email addresses as having been obtained by attackers and potentially usable for subsequent phishing campaigns. BitBox has not yet found evidence of fund or mnemonic phrase leakage; CoinTracking users received fake emails requesting them to refresh API keys.