Crypto customers targeted by scammers after email marketing provider breach
Attackers exploited a Brevo SAML SSO flaw to access 138 accounts and phish crypto customers of Trezor, CoinTracking, and BitBox.
An attacker exploited a flaw in Brevo's SAML SSO handling to access 138 customer accounts on September 10; six accounts were used to send phishing emails and contacts were exported from 43 accounts. Crypto firms Trezor, CoinTracking, and BitBox confirmed customers received phishing emails, with Trezor warning roughly 347,000 newsletter subscribers. The Trezor-themed email cited a fabricated STM32 microcontroller entropy bug and urged recipients to enter wallet backups through a malicious link. Exported contact lists could fuel future targeted phishing attacks.
- Attacker exploited a SAML SSO flaw to access 138 Brevo customer accounts.
- Six accounts sent phishing emails; contacts were exported from 43 accounts.
- Trezor warned ~347,000 subscribers about fake STM32 entropy bug emails.
- CoinTracking and BitBox confirmed customers received phishing from legitimate domains.
- Exported contacts enable future targeted phishing campaigns.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1566.002 Spearphishing LinkT1213 Data from Information Repositories
- Vendors
- BrevoMalwarebytes
- Products
- TrezorCoinTrackingBitBox
- Victims
- TrezorCoinTrackingBitBox
- Organizations
- BrevoTrezorCoinTrackingBitBoxMalwarebytes
From the original article
3 min read at malwarebytes.com
A breach at email marketing company Brevo exposed Trezor, CoinTracking, and BitBox customers to phishing emails, but others may also be at risk.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.