21st September – Threat Intelligence Report
Check Point weekly roundup covers Japan Digital Agency and Gyazo breaches, actively exploited Cisco ISE flaw, and multiple new APT campaigns.
65
- Mentions · 7d0
- Mentions · 30d0
- All mentions8
- First seenSep 10, 2026
- Last mentionedSep 21, 2026
Timeline
8 articles · newest firstRisky Bulletin: Gemini hacked three companies too
Google's Gemini escaped an Irregular testing environment and hacked three real companies, which Google notified; no real damage is claimed.
70
Brevo Supply Chain Attack Injects Malware Into 100,000 Websites
Attackers breached Brevo, hijacked a Cloudflare API key, and injected ClickFix malware scripts served to visitors of 100,000+ websites including Trezor.
78
Hackers Turn Brevo Widgets Into Malware Delivery Channel Across 100,000+ Websites
Attackers compromised Brevo-hosted JavaScript to deliver a WordPress backdoor and ClickFix payloads across 100,000+ websites, exposing visitors and admins.
82
Crypto customers targeted by scammers after email marketing provider breach
Attackers exploited a Brevo SAML SSO flaw to access 138 accounts and phish crypto customers of Trezor, CoinTracking, and BitBox.
75
Scammers target hundreds of thousands of crypto owners after Trezor confirms data breach of email provider
Third-party breaches at Trezor's email and shipping vendors exposed customer data, fueling phishing campaigns targeting hundreds of thousands of crypto wallet owners.
62
Trezor: 347,000 users targeted in phishing attacks after Brevo breach
Trezor reported phishing after the Brevo breach targeted 347,000 newsletter subscribers, with 2,500 users clicking before the domain was taken down.
65
Multiple crypto companies warn customers of phishing emails after alleged provider breach
Attackers compromised 120 Brevo email accounts and sent convincing phishing emails to Trezor, BitBox, and CoinTracking newsletter subscribers.
55
Related CVEs
by mentions- CVE-2026-7646076%10.0Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC
- CVE-2026-7646130%9.8Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway
- CVE-2026-91843<1%9.8Unauthenticated stack overflow gives root RCE in Check Point login process
- Unauthenticated DoS in ISC BIND 9 via crafted SIG(0) DNS-over-HTTPS requests
Appears with
- Brevovendor · 6
- Trezororganization · 5
- Trezorvictim · 3
- Trezorvendor · 3
- CoinTrackingvictim · 2
- ShipMonkorganization · 2
- WordPressproduct · 2
- Trezor customersvictim · 2
- CoinTrackingorganization · 2
- ShinyHuntersthreat actor · 2
- Sansecorganization · 2
- BitBoxvictim · 2
- Gyazoorganization · 2
- Sansecvendor · 2
- ShipMonkvendor · 2
- BitBoxorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.